removeAllow is removing all permissions about node_acl HOT 4 CLOSED

You will need to write a complete use case that reproduces this error, otherwise it is very difficult to help you...

from node_acl.

I granted 2 permissions with:

acl.allow('usrgrp_230', 'aco_9990', ['view', 'update']);

Currently in my local MongoDB in the acl_allows_aco_9990 collection:

/* ... */

/* 9 */
{
    "_id" : ObjectId("537fc18e0699b9d2c8fe0132"),
    "key" : "usrgrp_230",
    "view" : true,
    "update" : true
}

Both permissions are there exactly as expected. Now I want to remove the 'update' permission so I run:

acl.removeAllow('usrgrp_230', 'aco_9990', 'update');

I would expect to get

/* ... */

/* 9 */
{
    "_id" : ObjectId("537fc18e0699b9d2c8fe0132"),
    "key" : "usrgrp_230",
    "view" : true
}

in my DB, but instead I get:

/* 8 */
{
    ...
}

/* no 9th item here now! */

I even confirmed I wasn't overlooking something by querying for 'view' permissions still with the isAllowed() function and getting a false result. All permissions are missing too happens if I were to remove just the 'view' permission.

Thank you :)

from node_acl.

I can confirm that this is an issue. I have narrowed it down to line 259 of acl.js in the removeAllow function.

   if(cb){
      permissions = makeArray(permissions);
    }else{
      cb = permissions;
      permissions = null;
    }

I am not sure why there is a check on cb, I can not see the logic here. I have commented it out and the unit test pass for the memory backend. The reason why this is happening is because instead of passing the cb param to removeAllow we are using .then(), this then nulls out the permissions variable before it is passed on to removePermissions().

If there is no particular reason for this if statement I suggest it be removed.

Like mentioned above I have only tested against the memoryBackend but while doing so and having the if statement commented out both

line570

      acl.removeAllow('fumanchu', 'news', 'delete').then(function(){
        done()
      });

      acl.removeAllow('fumanchu', 'news', 'delete', function (err) {
        assert(!err)
        done()
      });

work but when not commented out the first .then() fails.

On another note the it statement claims to 'Remove delete and put permissions from resource news from role fumanchu' when in reality it is trying to only remove the 'delete'. 😉

from node_acl.

@christophertrudel yeah that piece of code seems to be totally wrong. This are remains from when the code was not promise based. Im going to fix it right away.

from node_acl.