I have hidden a module (a tab) via the app model depending on different user roles using this block of code in the A12 fullstack template
/**
* On login, registers all modules that current user has access to.
*/
export const registerModulesOnLoginMiddleware = StoreFactories.createMiddleware((api, next, action) => {
if (UaaActions.loggedIn.match(action)) {
const user = action.payload.user as UaaOidcUser;
getUserAccessibleModules(user).forEach(m => {
ModuleRegistryProvider.getInstance().addModule(m);
});
}
return next(action);
});
/**
* Filters a given array of modules based on the access rights of the user and the `roles` annotation in the appmodel.
* @param user The logged in user
* @param modules All modules in the application for role based checks
* @returns An array of modules the user has the rights to access
*/
export function getUserAccessibleModules(user: UaaOidcUser): Module[] {
return INTERNAL_MODULES
.map(module => {
const moduleAnnotations = module.model && module.model({}).header.annotations;
const requiredRoles = moduleAnnotations?.find(a => a.name === "roles")?.value?.split(",");
// Some modules might have no roles, so ensure they are added
const userHasRole = !requiredRoles || userHasAtLeastOneRole(user, requiredRoles);
return userHasRole ? module : undefined;
})
.filter(Boolean) as Module[];
}
export function userHasAtLeastOneRole(user: UaaOidcUser, requiredRoles: string[]): boolean {
const userRoles = user.profile["resource_access"][CFISettings.roleLocation].roles;
return requiredRoles.some(roleName => userRoles.indexOf(roleName) >= 0);
}
The module is hidden as expected when I use a user that does not have permission. But when I access the model via API ex: http://localhost:7788/api/v2/models/VSMA-overview or http://localhost:7788/api/v2/models/DomainVSMA or http://localhost:7788/api/v2/models/VSMA, it still can return the model. I did add the role annotation in the domain model, overview model, and UI model like this:
"annotations": [
{
"name": "roles",
"value": "VSMA_ADMIN"
}
],
Does anyone have an idea for this?