[Question] Decoupling from sails-generate-auth? about sails-permissions

[tjwebb]

sails-permissions includes sails-auth as a dependency mainly because it relies on the User model. You'll see in the setup instructions that the first step is running sails generate auth-api; in your case, you could probably just skip this step. In config/policies, you'd replace 'passport', 'sessionAuth' with your own. The sails-permissions policies expect to see req.user, but I think that's it.

[tjwebb]

In terms of the project's status, it currently is working for owner-only permissions. That is, an owner of an object automatically has full permissions for objects he/she creates, and other users cannot access objects they did not create. (I've implemented it in https://github.com/hashware/api and am basically UAT-ing it currently). This is fine for simple user account management, but obviously is not yet suitable for any case where you'd want users being able to share objects. I'll use the suggestions here (balderdashy/sails#2387) to implement that feature, which requires that I inspect objects after they are queried, but before they are returned to the client, in order to verify transitive role-level permissions.

[arryon]

Ok, this answers the question nicely, thank you. Will spend some time trying to integrate it all.