Multiple Authentication with AdonisJS V5

[jmartecep]

How can you create Role Based Authentication with AdonisJS Version5?

When using "npm i @adonisjs/auth@alpha", you are prompted to pick which model you want to use, for example USERS. I would like to expand this functionality to admins.

Is this possible, and if so how do you make it happen?

@thetutlage

Jamie

[popovicieduard]

[jmartecep]

Thank you @popovicieduard. Much appreciated.

[thetutlage]

Roles based authorization should be handled using the Authorization layer and not authentication. Users should always authenticate in one way, should live in one table, but assigned different roles.

[nickngqs]

Hi, looking forward to use v5! Just curious, previously i saw ACL(roles & permissions) as one of the features on the Adonisjs Trello Roadmap, or was I seeing things?

[popovicieduard]

Yes it is, it's not implemented right now. maybe @thetutlage can give you more details about roadmap when he has time.

[jmartecep]

Thank you @thetutlage.

[jmartecep]

@thetutlage,
I've been hacking and I have another question. Looking at the config/auth.ts and the contracts/auth.ts file I see that the user model is primary. I watched a Laravel 5.4 video; https://www.youtube.com/watch?v=iKRLrJXNN4M, and the gentleman was able add Admin as one of the web guards. Would this be possible in adonisjs 5? If not, how can I create an Admin login/logout, with out merging the user and admin models?

Thanks,
Jamie

[jmartecep]

So I couldn't find an answer at all, and I'm upset about it. Going to a coding boot camp does not prepare you for frameworks such as these. @thetutlage , it would be nice for you entertain this issue, I'm sure I'm not the only one facing this challenge. I believe in this product, and I want to get this issue resolved. Kindly reply with a possible resolution.
Much Appreciated,
Jamie

[fairhat]

You can create custom middleware as documented here:
https://preview.adonisjs.com/guides/http/middleware#route-middleware

Assuming you only need to differentiate between admin/not-admin:
Add a boolean value "isAdmin" to your User Model and create a middleware as described in the Link above.
Lets say you only want to allow admins:

routes.ts

Route.get('/admin-dashboard', 'AdminController.dashboard').middleware(['auth', 'acl:admin'])

Middleware/ACL.ts

import { HttpContextContract } from '@ioc:Adonis/Core/HttpContext'

export default class ACL {
  public async handle (
    { request, auth }: HttpContextContract,
    next: () => Promise<void>,
    allowedRoles: string[],  ) {
    if (allowedRoles.includes('admin') && !auth.user.isAdmin) {
      throw new Error('User ist not an admin')
    } else {
        await next()
    }
  }
}

Not sure if that is the right way this should be done in AdonisJS, but nevertheless this should work:
This is obviously very simplified but now every route that has 'auth' and 'acl:admin' as middlewares can only be used by users if "isAdmin" is true

In more advanced cases (indefinite amount of roles and different permissions for groups) you should read some tutorials or maybe better books about Authentication, Authorization and Access Control for Applications

Bootcamps are bootcamps because they only teach you (in the best case) the minimum necessary to be able to program stuff that companies commonly expect from developers. The field you are in is a lot bigger than that though. So don't get too frustrated if people don't answer these questions here, as your question implies that you need to learn a lot more basics to be able to use a framework like this.

If you're new to programming and just need some backend with minimum code, you should check out:
https://directus.io/
https://strapi.io/

You don't always have to dig into code to achieve the results you want. Keep that in mind in your journey ;P

[jmartecep]

Hi Fairhat, thank you very much for you insight on this issue. I will be working it the remainder of the week to get it up and running.
Once again, many thanks
Jamie

[fairhat]

Also: Frameworks like Laravel and Adonis can give you the impression that "everything just works easy without doing much yourself" but that means if you know what's happening, it's easier and faster to get it done with the framework instead of writing it on your own. It does not mean that you don't need to know what they are doing. If you interpret it the wrong way, you're not going to enjoy what they offer to you.

Maybe an application content related (opposed to framework related) discussion label would be helpful for beginners, @thetutlage ?
I assume there will be lots of other questions like this in the future