Sails.js policy not working for a single controller - sails.js

Question

I have 4 Policies in sails.js, SuperUser, Admin, User and SuOrAdmin and 3 models with the blueprint controllers, this is the policies config:
'*': 'SuperUser',
User:{
'*': 'SuOrAdmin',
findOne: 'User'
},
Empresa:{
'*': 'SuperUser',
findOne: 'Admin',
findOne: 'User'
},
Noticia:{
'*': 'SuOrAdmin',
find: 'User',
findOne: 'User'
}
when i log in with the SuperUser i can CRUD all the models except the find method of Noticia, but when i log in with an Admin i can CRUD the Noticia model, this is the SuOrAdmin policy:
module.exports = function(req, res, next) {
// User is allowed, proceed to the next policy,
// or if this is the last policy, the controller
if ( (req.session.user && req.session.user.admin) || (req.session.SuperUser) ) {
return next();
}
// User is not allowed
// (default res.forbidden() behavior can be overridden in `config/403.js`)
return res.json(403, {error: 'You are not permitted to perform this action.'});
};
Can somebody help me please, i have been stucked 2 days in this problem.
#mikermcneil

Answer 1

You can apply multiple policies to a single function as below
Noticia:{
'*': 'superAdmin',
find: ['isUser','isSuperAdmin','isAdmin'],
...
}
In some cases this may still not be the easiest approach.
An alternative simpler way in your case could be that you include each level in the previous one, so a higher level user can always use a lower level user permissions, for example, these are your levels
isUser
isAdmin
isSuperAdmin
In the isUser method , first check if its an admin, return next, then check your user logic
module.exports = function isUser(req, res, next) {
if(is_admin)return next(); //you need to provide logic for is_admin here
//remaining user check logic below
....
}
Similarly in the Admin method, first check if its SuperAdmin and return next, then check your admin logic
module.exports = function isAdmin(req, res, next) {
if(is_su)return next(); //you need to provide logic for is_su here
//remaining admin check logic below
....
}

Answer 2

definitely check out #arkoak's answer as far as an approach. I'm not sure if this will solve your complete problem or not, but here's something else that might help.
Currently, you're mapping models on the LHS of your policies config. The reason it's working is because we have some decent guessing logic in-place-- but actually you want to be using controllers. Policies are just configurable middleware that sit between incoming requests from users and your controller actions.
So for instance, instead of User as the key, try:
UserController:{
'*': 'SuOrAdmin',
findOne: 'User'
}
The other thing I'd mention is to clarify that policies do not cascade-- that is, if you have:
'*': 'foo',
NoticiaController: { '*': 'bar' }
...then the actions of NoticiaController will only be protected under bar (not foo AND bar- catch my drift?)
As for your exact problem of not being able to find from Noticia as a superadmin, I believe it's because your policies are mutually exclusive, like what #arkoak suggested.
Hope that helps!