权限设计

设计思想：
1、拿到请求的url,/api/uses/addUsers 和对照表/conf/authAndApi.js，找到对应的permition：addUsers
2、数据库中查找当前登录用户的所有权限（整合）
3、根据请求的permition addUsers和数据库中的addUsers的值做比较
/conf/authAndApi.js

module.exports = [
    {permition:'addUsers',authnanme:"添加用户",baseurl:'/api/users/addUsers'},
    ...
}

/conf/defaultPermissions.js

module.exports = {
    /*安全中心的权限*/
    setProjectPolicy:false,//新建项目策略
    queryProjectPolicy: false,//查看项目策略
    ...

/conf/initAuthority.js

module.exports = {
	systemAdmin: {
		queryStr: true,
		addStr: true,
		updateStr: true,
	}
	...

./app.js

...
var url = req.params[0].trim();
...
var shortUrl = "";
for (var i = 0; i < AuthAndApi.length; i++) {
     if (AuthAndApi[i].baseurl == url) {
     	shortUrl = AuthAndApi[i].permition;
     	 }
      }
 	db.query(UserRoleSql.queryUserPermiss, req.headers.username, function (err, rows) { 
 		if (err) {
 			logger.error("Database operation error! error: ", err);
 			return res.status(200).json({ code: 1, msg: "Database operation error!", data: null });
 		} else if (rows[0]) {
 			var resultsPermiss = {};
 			for (var i = 0; i < rows.length; i++) {
 				if (i == 0) {
                    var permissList = JSON.parse(rows[i]['permissList']);
                     Object.assign(resultsPermiss, permissList);
               	} else {
               		var permissList = JSON.parse(rows[i]['permissList']);
               		var empObj = {};
               		for (var k in permissList) {
               			if (permissList[k]) {
               				 var key = k;
               				 var empObj = {};
               				 empObj[key] = permissList[k];
               				 Object.assign(resultsPermiss, empObj);
               				   }
               		 		}
               		  	}
               		}
               		if (resultsPermiss[shortUrl] == true) {
               			...
               			next()
               			...
               			}

.....                                                                                                                                            

本文地址：https://blog.csdn.net/qq_38504352/article/details/107386398