Roles functionality

[Juzzers]

I'm submitting a...

[ ] Regression (a behavior that used to work and stopped working in a new release)
[ ] Bug report  
[x ] Feature request
[ ] Documentation issue or request

Current behavior

Although roles can be defined using addRoles, assigning a name and a list of permissions, there appears to be no functionality gained by doing so, that I can see. The permission list is ignored and only the role names are relevant. Perhaps I'm misunderstanding.

Expected behavior

I would expect the ability to assign one or more of the defined roles to the current session and that the relevant permissions would be included in authorization checks such as ngxPermissionsOnly.

Minimal reproduction of the problem with instructions

// Define a role in typescript
this.roleService.addRole('ANALYST', [
            'accessAnalystsSection'
        ]);

// Use the assigned permission from the list in a directive in html
<div *ngxPermissionsOnly="['accessAnalystsSection']">
<p>I have Analyst permission.</p>
</div>

// The above will never be displayed because the permission list defined above is ignored, only the role name is checked in the NgxRolesService.hasRolePermission method

Environment

Angular version: 6.1.6
ngx-permissions version: 6.0.1


Browser:
- [x ] Chrome (desktop) version XX
- [ ] Chrome (Android) version XX
- [ ] Chrome (iOS) version XX
- [ ] Firefox version XX
- [ ] Safari (desktop) version XX
- [ ] Safari (iOS) version XX
- [ ] IE version XX
- [ ] Edge version XX

[g-schmitz]

+1

[harley1011]

+1

[AlexKhymenko]

@Juzzers It's because You need to define permissions also. so in this case You need to do is this.permissionsService.addPermission('accessAnalystsSection') and then define role

[jonathanwoahn]

What's the purpose of adding permissions as well in the NgxRoleService.addRole('ADMIN', [...])? I would have thought adding the permissions there would override the need to do it in the PermissionService.

[Juzzers]

@Juzzers It's because You need to define permissions also. so in this case You need to do is this.permissionsService.addPermission('accessAnalystsSection') and then define role

Thanks, but it seems to me that addPermission will grant that permission to the current session won't it? So if you first need to grant every permission before you can create any roles, what difference does it make having the roles? If you have 3 different roles, you first grant every permission in every role before you can create them?

[blackholegalaxy]

I agree. I don't see the point to have roles which can contain an array of permissions if adding a role doesn't create the corresponding individual permissions.

If I had to do:

this.permissionsService.loadPermissions(['createTopic']);
this.rolesService.addRole('employee', ['createTopic']);

and in my component I want to ensure the current user has createTopic permission. What is the point to have correponding role?

I would expect that this.rolesService.addRole('employee', ['createTopic']); would create the createAnnounce permission and add it to the current user.

[AlexKhymenko]

@Juzzers @blackholegalaxy I gave it much thought why i haven't dont this its cause i was thinking use case when permissions are functions. I guess i will implement that when You pass array it will add permissions also (it will be less confusing for users of the library).

[AlexKhymenko]

@Juzzers @blackholegalaxy The only problem is that right now it covers the use case when you have you need to compare with '&&' You will use roles. I will need to create new method for this one is the name addRolesWithPermissionsDefined is good for You or maybe i should use different name?

[blackholegalaxy]

addRolesWithPermissions would be sufficient I guess.

In the readme, I don't see much explaination about having the permissions being functions. What is a real world use case for that?

[AlexKhymenko]

@blackholegalaxy You can define Your custom logic for example if You need && or || or Make a call to the backend and it will check if allowed You can do anything.

[AlexKhymenko]

regarding this issue i have implemented it but there is one problem cause when You want to delete role You expect that that roles will be also deleted

[LuisBonsembiante]

Hi everyone..any news about that?..is an importatn funtionality...thanks

[troydietz]

I’m also very confused as what purpose providing a permissions array to the role does? What was the motivation in allowing the permissions array as a second parameter to roles?

That’s particularly confusing because the docs give examples where a permissions array is being used.

[AlexKhymenko]

@troydietz this cover cases when for example You need to use 'AND' operator. For example User should have permissions 'ADMIN' 'EDITOR' at the same time. You can't do it with permissions cause its checking 'OR' operator.

Hope this helps

[ssaadoun2010]

I agree. I don't see the point to have roles which can contain an array of permissions if adding a role doesn't create the corresponding individual permissions.

If I had to do:

this.permissionsService.loadPermissions(['createTopic']);
this.rolesService.addRole('employee', ['createTopic']);

and in my component I want to ensure the current user has createTopic permission. What is the point to have correponding role?

I would expect that this.rolesService.addRole('employee', ['createTopic']); would create the createAnnounce permission and add it to the current user.

Even though, the example above works when loading only one permission! It doesn't work when there are more than one:

this.permissionsService.loadPermissions(['createTopic', 'editTopic']);
this.rolesService.addRole('employee', ['createTopic', 'editTopic']);

any updates on this feature?

[hmarcelodn]

How does it works currently? Can I define the permissions for every role, and then by just loading the role get all my permissions? like:

['ADMIN', canViewDocuments, canEditDocuments]
['EDITOR', canViewDocuments]

Can I load EDITOR, and acquire all the permissions for EDITOR ?

[troydietz]

I am still very confused at what benefit the role provides since you must add all permissions before the role. If the author could give a short example (with code) demonstrating the use case, perhaps that would help clear up my confusion. I'm sure you had a valid reason for taking the approach you did.

[AlexKhymenko]

Hi @troydietz . Sorry for the late reply. The biggest difference between role and permission and when You have role and You add permissions it will check with '&&' Operator. So for example You need that the user should have admin and editor permission. You just create 'Super user' role and add this two permissions.

this.rolesService.addRole('SuperUser', ['admin', 'editor']);
And then just use in *ngxPermissionsOnly="SuperUser"

I will try to update wiki page. Hope this helps.

[weiztech]

Hi @troydietz . Sorry for the late reply. The biggest difference between role and permission and when You have role and You add permissions it will check with '&&' Operator. So for example You need that the user should have admin and editor permission. You just create 'Super user' role and add this two permissions.

this.rolesService.addRole('SuperUser', ['admin', 'editor']);
And then just use in *ngxPermissionsOnly="SuperUser"

I will try to update wiki page. Hope this helps.

with role as superuser
this.rolesService.addRole('SuperUser', ['admin', 'editor']);

and want to allow only editor permissions.

did SuperUser role work with *ngxPermissionsOnly="editor" ?

if not work, is there any way to do that ?

thanks

[AlexKhymenko]

Hi @weiztech. I understand what You are talking about to make it work. You need first add permissions.

this.permissionsService.addPermissions['admin, 'editor;]
this.rolesService.addRole('SuperUser', ['admin', 'editor']);

Then everything will work.
*ngxPermissionsOnly="editor"
*ngxPermissionsOnly="SuperUser"

[troydietz]

@AlexKhymenko Thank you for your response. I think I understand where the confusion is coming from. The way I think I'd use a role is a different from you. In most cases, I would never think of using a role in the ngxPermission directive. Instead, I'd only use permissions.

For example, this is how I imagine using roles and permissions:

<div *ngxPermissions="canViewMessage">
  <div *ngFor="message in messages">
    <span>{{ message }}</span>
    <a *ngxPermissions="canDeleteMessage" (click)="deleteMessage(message)">Delete</a>
  </div>
  <compose-message *ngxPermissions="canPostMessage"></compose-message>
</div>

Possible roles:
role: Anonymous, permissions: [canViewMessage]
role: User, permissions: [canViewMessage, canPostMessage]
role: Admin, permissions: [canViewMessage, canPostMessage, canDeleteMessage]

I can't think of a time where I'd really want to say *ngxPermissions="Admin". And since with ngx-permission you have to load all of the permissions before creating the Admin role, creating the role doesn't provide me anymore benefit. To be clear, I'm not saying your approach is wrong, I'm just starting to understand why I was confused before. I think you and I think of using roles in slightly different ways.

Thank you very much for your response 😃

[weiztech]

Hi @weiztech. I understand what You are talking about to make it work. You need first add permissions.

this.permissionsService.addPermissions['admin, 'editor;]
this.rolesService.addRole('SuperUser', ['admin', 'editor']);

Then everything will work.
*ngxPermissionsOnly="editor"
*ngxPermissionsOnly="SuperUser"

Thanks, its worked 👍

[jbjhjm]

Possible roles:
role: Anonymous, permissions: [canViewMessage]
role: User, permissions: [canViewMessage, canPostMessage]
role: Admin, permissions: [canViewMessage, canPostMessage, canDeleteMessage]

I second that. It would make much sense to define a role as a collection of certain permissions/attributes. So the user is assigned a certain Role like Visitor or Admin or RegisteredVip possibly. Each of these roles has certain permissions assigned and in code one would just check against these attributive permissions.

On second thought, as much sense as it would make, this kind of role system doesn't have much to do with ngxPermissions. Such roles depend on the user management system one chooses to use.

Also, the readme could use better examples. As far as I understand the concept right now, we should think of a role like a collection of REQUIRED permissions.

So a role would look like HasAllManagementRights = [canEdit, canDelete, canToggle]

And then one could use <div *ngxPermissionsOnly="'HasAllManagementRights'"> to make sure a user has all of these permissions.
A better wording may be to simply name them permissionGroups.

I recommend to add a bold and explicit note into the readme to clarify what this role system is and what it is not.

[weilies]

hi Alex,

My TS as below

    this.permissionsService.addPermission(['addCompany', 'addUser', 'configPay'])
    this.rolesServices.addRole('SUPERMAN', ['addUser', 'configPay'])

template as below

<ng-template [ngxPermissionsOnly]="addCompany">
	<div>You can add company</div>
</ng-template>

<ng-template permissions [ngxPermissionsOnly]="['addCompany', 'addUser']">
	<div>You can add company or user</div>
</ng-template>

<ng-template [ngxPermissionsOnly]="configPay">
	<div>You can configure pay</div>
</ng-template>

<ng-template [ngxPermissionsOnly]="addOthers">
	<div> can add others</div>
</ng-template>

Expected output

You can add company or user
You can configure pay

Actual output

You can add company
You can add company or user
You can configure pay
can add others

I am quite confused as my intention is to call myself "SUPERMAN" (role) with given permissions 'addUser', 'configPay'. So, technically, for any doesn't have the two, should be hide, shouldn't it?

[g-schmitz]

That's because this project is very counter-logical / counter-intuitive and actually doesn't help with what 99% of people are trying to achieve with it. Very unfortunate because it is an otherwise very beautiful project as far as I'm concerned.

[weilies]

That's because this project is very counter-logical / counter-intuitive and actually doesn't help with what 99% of people are trying to achieve with it. Very unfortunate because it is an otherwise very beautiful project as far as I'm concerned.

OMG!! i hope what you said isn't true... i jz came from CASL given the popularity, i decided to move to ngx-permission instead and straight away i hit a huge roadblock

[dtomaszewski]

Hi @AlexKhymenko do You have any plans to change this functionality ? I think a lot of users (so do I) are confused with need to mantain permissions in two places. I had exactly the same doubts as people in this thread and I was not able to exactly know how lib works from docs without console logging output and reading this thread.

Maybe at least some config should be added to have all permissions combined ?

[AlexKhymenko]

Hi @dtomaszewski I actually developed this functionality but something stoped me. I will revisit this functionality :-)

[AlexKhymenko]

Thank For all Your patience. Added this functionality + more. Added addRoleWithPermissions, addRolesWithPermissions, flushRolesAndPermissions. Available in 8.1.1. Have a great day :-)

[dtomaszewski]

Thanks @AlexKhymenko I'll check it asap :)