feathers

feathers copied to clipboard

Steps to reproduce

I have a simple webapp with a Users service. Authentication is based on this service and works as expected. However I have a field in the User record which is used as part of an Authorization check. I am using real time connections via socket.io. If a user is logged in and their User record is updated, the context.params.user object is not updated until the client app fully resets the connection(s). I actually haven't figured out how to do this without triggering a window refresh from the client side.

This subscription to an event successfully updates the database with the appropriate record

  app.service('room').on("created", (data: any, context: HookContext) => {
    // Add access to user on create
    var email = context.params.user.email
    var access= [...context.params.user.access, data.access]

    app.service('users').update(context.params.user._id, {
                                    email:email,
                                    access: access
                                  }).then(() => {console.log('access updated')})
  })

However creates of records which are in this room should be filtered only to the owner of that room, and the following publish of that events filter is filtering it out.

  app.service('request').publish('created', (data:any, _context: HookContext) => {
    return app.channel('authenticated').filter((context) => {
      return context.user.access.includes(data.room)
    })
  })

The reason the record is being filtered is that context.user.access is unchanged from when it was originally populated when the user initially authenticated. Triggering a hard refresh in the client application in the browser resolves the issue and the application receives events as expected.

Expected behavior

When the underlying data for a user is updated via a service subsequent calls should see that change reflected in the user object stored in the context.

OR

I should be able to invalidate and trigger a refresh or update the existing context and have it persist to future calls.

Actual behavior

context.user continues to contain only the state of the user object when the session was initiated.

System configuration

Tell us about the applicable parts of your setup.

Module versions (especially the part that's not working):

"@feathersjs/authentication": "^5.0.0-pre.31",
"@feathersjs/authentication-local": "^5.0.0-pre.31",
"@feathersjs/authentication-oauth": "^5.0.0-pre.31",
"@feathersjs/configuration": "^5.0.0-pre.31",
"@feathersjs/errors": "^5.0.0-pre.31",
"@feathersjs/feathers": "^5.0.0-pre.31",
"@feathersjs/koa": "^5.0.0-pre.31",
"@feathersjs/memory": "^5.0.0-pre.20",
"@feathersjs/mongodb": "^5.0.0-pre.31",
"@feathersjs/schema": "^5.0.0-pre.31",
"@feathersjs/socketio": "^5.0.0-pre.31",
"@feathersjs/transport-commons": "^5.0.0-pre.31",
"@feathersjs/typebox": "^5.0.0-pre.31",
"feathers-hooks-common": "^7.0.0-pre.1",
"google-auth-library": "^8.6.0",
"koa-static": "^5.0.0",
"mongodb": "^4.11.0",
"uuid": "^9.0.0",
"winston": "^3.8.2"

NodeJS version: v16.18.0

Operating System: Windows

Browser Version: Firefox 106.0.1

Module Loader: npm v8.19.2