Find Doc Without Permissions

Question

I'm working on adding password reset functionality to users on my Apostrophe CMS installation. I'm using this code to find the user by email address and create a new token for later use: (in lib/modules/apostrophe-users/index.js)

module.exports = {
    construct: function(self, options) {
        self.route('post', 'send-reset-token', function (req, res) {
            var email = req.body.email;
            var usersModule = self.apos.modules['apostrophe-users'];
            var userList = usersMods.find(req, {email: email}, {permissions: false});
            userList.toArray(function (err, arr) {
                if (arr.length > 0) {
                    //Create token
                }
            });
        }
    }
}

But, when this request is made from a non-logged-in session (which is the point of the reset), the list of users is blank. I thought (from reading documentation) that setting the options.permissions param to false, it would get the user without checking for permissions first, but it doesn't seem to be working. I can get the user correctly when I make this call when logged in as admin.

Is there something else I need to do to find this user on the server side without the requesting person having permission to see users?

Tom Boutell Tom Boutell · Accepted Answer · 2017-07-24T21:15:46

The second argument to find is the MongoDB criteria object. permissions is not a property of any object in the collection, so you get back nothing.

permission is singular and it is a cursor filter method, not a property of an options object. We don't use an options object with find because chainable filter methods are more flexible, documentable and testable.

What you are looking for is:

return usersModule.find(req, {email: email}).permission(false).toObject(function(err, user) {
  if (user) {
    // There was a user
  }
})

Note that permission is singular here.

The only place you'd find this described as part of an options object is in documentation for the old 0.5 release. The official docs for 0.5 have a big warning at the top. Let me know if you found this information on a page without a warning and I can work on getting that fixed.

Find Doc Without Permissions

1 Answers