检查“created_by”属性后，无法删除播放器对象

Posted 2021-04-08

我有一个DELETE操作作为我构建的NodeJS API的一部分。此删除应执行以下操作：

• 使用提供的ID删除播放器对象
• 它不应该删除由其他用户创建的播放器。

在测试中，如果播放器由另一个用户创建，但在尝试删除该对象时失败。这是代码：

router.delete('/:id', validateBearerToken, function(req, res) {
  let playerId = req.params.id;
  //get player object
  let player = Player.find({created_by: playerId
  }, function(err) {
    if (err) return res.status(409).send('There was a problem finding the players.');
  });

  if (player.created_by !== getUserFromBearerToken(req.token)) {
    return res.status(404).send('The player not created by this user');
  }
  Player.findByIdAndRemove(playerId, function(err) {
    if (err) {
      return res.status(404).send('There was a problem deleting the player.');
    }
    res.status(200).send({
      success: true
    });
  });
});

validateBearerToken用于检查执行删除操作的用户是否有效

function validateBearerToken(req, res, next) {
  let bearerToken;
  let bearerHeader = req.headers.authorization;
  if (typeof bearerHeader !== 'undefined') {
    let bearer = bearerHeader.split('Bearer ');
    bearerToken = bearer[1];
    req.token = bearerToken;
    next();
  } else {
    res.status(403).send();
  }
}

gertUserFromBearerToken用于获取登录用户的id以与测试中的'created_by` id进行比较：

function getUserFromBearerToken(token) {
  const decodedtoken = jwt.decode(token, process.env.JWT_SECRET);
  return decodedtoken.id;
}

答案

验证中间件（validateBearerToken）应该是这样的

function validateBearerToken(req, res, next) {
  var token = req.headers.authorization || req.headers['x-access-token'];
  if (!token)
    return res.status(403).send({ auth: false, message: 'No token provided.' });
  jwt.verify(token, process.env.JWT_SECRET, function(err, decoded) {
    if (err)
    return res.status(500).send({ auth: false, message: 'Failed to authenticate token.' });
    // if everything good, save to request for use in other routes
    req.userId = decoded.id;
    next();
  });
}

然后在删除路由检查id这样的

if (player.created_by !== req.userId) {
    return res.status(404).send('The player not created by this user');
}