z0mt3c/node-restify-swagger — pull request #16 by metasection (2014-11-16 18:48:15+00:00)
Title: Authorizations and Access Control to hide API methods and check access (2nd Attempt)

This Pull Request addresses issue #11.

Feedback on implementation is welcome. Pull would be greatly appreciated. Thanks again for building node-restify-swagger.

# Usage / Implementation

## Hiding routes based on authorization...

- You create an accessControl function and pass it to the loadRestifyRoutes. The accessControl function returns a space delimited list of user-authorizations (Example: "public account admin").

- You add an ‘authorizations’ parameter to each route (optional, defaults to public) with a space separated list of route-authorizations (Example: "admin super-admin").

- when swagger loads it calls the createResource method in node-restify-swagger which uses the accessControl method (if provided) to verify the api_key (if provided) and get the user-authorizations.

- it then iterates over all of the routes and verifies that the user-authorizations are sufficient to provide access to the route based on the route-authorizations.

* In our examples above, the user would have to have admin or super-admin in order to access the route. In our example, the user has public, account, and admin. Therefore, the user can see and access the route because it has the admin authorization required by the route.

## Authorize access middleware...

- You pass the accessControl function to the swaggerRestify.authorizeAccess middleware function

- Each time that the route is accessed, the middleware function is executed.