accounts-api
v1.0.0
Published
An accounts api that follows a few contraints to try and make it easy to plug into a node http server
Downloads
16
Maintainers
Readme
accounts-api
This app follows a few constraints to try and make it easy to plug into a node http server.
The goal is a simple API resource that can be used on its own or in other servers.
The file organization and approach is inspired in part by django's idea of apps.
Usage
To use it, you'd include it in the server like this:
var http = require('http')
var response = require('response')
var level = require('level')
var db = level('db')
var accounts = require('accounts-api')(db)
var server = http.createServer(function (req, res) {
/*
* if req.url matches a route, it will return,
* otherwise, another part of the application can respond
*/
if (accounts.serve(req, res)) return
response().json({ message: 'hi' }).pipe(res)
})
server.listen(4444)
Account roles
By default, there are three roles an account can have: admin, owner, collaborator
admin
- is a boolean, and gives site-wide access
- implies create, read, update, and delete scopes for all models
owner
- is an array of keys for models that the account has created or for which the account has been granted owner status
- implies create, read, update, and delete scopes on all models the account is an owner
collaborator
- is an array of keys for models for which the account has been granted collaborator status
- implies create, read, and update scopes on all models the account is a collaborator
Here's how you might check to see if a user is the owner of a model:
var access = auth.checkRoles(obj.key, account)
if (access && access.role === 'owner') {
// do the things that owners can do
}
Account scopes
Scopes are granular permissions for models or other arbitrary actions in your application.
By default there is an accounts
scope, and all users are allowed to read
accounts.
Here's an example of adding a custom posts
scope to accounts so you can check if an account has the proper scope in other parts of your application:
var createAccounts = require('accounts-api')({
secret: 'test',
scopes: {
posts: {
type: 'object',
properties: {
actions: {
type: 'array',
items: { type: 'string', enum: ['create', 'read', 'update', 'delete'] }
}
},
default: { actions: ['create', 'read'] }
}
}
})
var accounts = createAccounts({ db: memdb() })
To check if an account has the proper scope:
auth.checkScopes(['read:posts', 'create:posts'], account)
Todo
- decide how to handle static assets, and how they might be handled across the application
Structure
- index.js
- this module provides the model, handler, and routes modules of the app
- it also provides a
serve
method that is used to match req.url to the app's routes
- routes.js
- a simple router that takes the handler as an argument, and matches routes to handler methods
- handler.js
- takes the model as an argument, and parses requests to perform operations with the model
- model.js
- provides CRUD and other necessary actions like validation, indexing, etc. This is based on accountdown and leveldb.