About how the value is returned using app.set() and app.get()

Question

I am releasing access to pages using connect-roles and loopback but I have a pertinent question about how I can collect the customer's role and through the connect-roles to read the session and respond to a route.

Example, when the client logs in I load a string containing the client's role and access it in a function that controls access to pages.

I have this doubt because I'm finalizing a large scale service that usually there are multiple client sessions that are accessed instantly using a same storage and check function.

It would be efficient to store the customer's role using app.set() and app.get()?

  app.get('/session-details', function (req, res) {
    var AccessToken = app.models.AccessToken;
    AccessToken.findForRequest(req, {}, function (aux, accesstoken) {
      // console.log(aux, accesstoken);
      if (accesstoken == undefined) {
        res.status(401);
        res.send({
          'Error': 'Unauthorized',
          'Message': 'You need to be authenticated to access this endpoint'
        });
      } else {
        var UserModel = app.models.user;
        UserModel.findById(accesstoken.userId, function (err, user) {
          // console.log(user);
          res.status(200);
          res.json(user);
          // storage employee role
          app.set('employeeRole', user.accessLevel);
        });
      }
    });
  });

Until that moment everything happens as desired I collect the string loaded with the role of the client and soon after I create a connect-roles function to validate all this.

var dsConfig = require('../datasources.json');
var path = require('path');

module.exports = function (app) {
  var User = app.models.user;
  var ConnectRoles = require('connect-roles');
  const employeeFunction = 'Developer';

  var user = new ConnectRoles({
    failureHandler: function (req, res, action) {
      // optional function to customise code that runs when
      // user fails authorisation
      var accept = req.headers.accept || '';
      res.status(403);
      if (~accept.indexOf('ejs')) {
        res.send('Access Denied - You don\'t have permission to: ' + action);
      } else {
        res.render('access-denied', {action: action});
        // here
        console.log(app.get('employeeRole'));
      }
    }
  });

  user.use('authorize access private page', function (req) {
    if (employeeFunction === 'Manager') {
      return true;
    }
  });

  app.get('/private/page', user.can('authorize access private page'), function (req, res) {
    res.render('channel-new');
  });

  app.use(user.middleware());
};

Look especially at this moment, when I use the console.log(app.get('employeeRole')); will not I have problems with simultaneous connections?

  app.get('/private/page', user.can('authorize access private page'), function (req, res) {
    res.render('channel-new');
  });

Example client x and y connect at the same time and use the same function to store data about your session?

Being more specific when I print the string in the console.log(app.get('employeeRole')); if correct my doubt, that I have no problem with simultaneous connections I will load a new variable var employeeFunction = app.get('employeeRole'); so yes my function can use the object containing the role of my client in if (employeeFunction === 'Any Role') if the role that is loaded in the string contain the required role the route it frees the page otherwise it uses the callback of failureHandler.

My test environment is limited to this type of test so I hope you help me on this xD

Answer 1

Instead of using app.set you can create a session map(like hashmaps). I have integrated the same in one of my projects and it is working flawlessly. Below is the code for it and how you can access it:

hashmap.js

var hashmapSession = {};

exports.auth = auth = {
  set : function(key, value){
    hashmapSession[key] = value;
  },
  get : function(key){
    return hashmapSession[key];
  },
  delete : function(key){
    delete hashmapSession[key];
  },
  all : function(){
    return hashmapSession;
  }
};

app.js

var hashmap = require('./hashmap');
var testObj = { id : 1, name : "john doe" };

hashmap.auth.set('employeeRole', testObj);
hashmap.auth.get('employeeRole');
hashmap.auth.all();
hashmap.auth.delete('employeeRole');