Parse.com下RouteProvider Resolve未限制访问，需实现管理员页面权限控制

Hey there! Let's tackle this admin access restriction issue you're facing. It sounds like your auth factory's async operation isn't finishing before the route resolves, which is causing the page to load prematurely. Let's break down how to fix this properly with Promise and .then() best practices.

Core Problem Recap #

Angular (I’m assuming AngularJS here given your mention of factories and route resolves) waits for all promises in a route’s resolve block to settle (either resolve or reject) before loading the page. If your auth factory isn’t returning a valid promise, or if your resolve logic isn’t properly chaining that promise, the route will skip ahead and load the page before validation completes.

Step 1: Fix Your Auth Factory to Return a Promise #

First, make sure your auth factory’s admin-check method returns a promise. If you’re using an API call (like checking user permissions against your backend), leverage Angular’s $q or just return the promise from $http directly (since $http already returns a promise).

Example auth factory:

app.factory('AuthFactory', ['$http', function($http) {
  return {
    // This method returns a promise that resolves if user is admin, rejects otherwise
    verifyAdminAccess: function() {
      // Replace with your actual admin-check endpoint
      return $http.get('/api/user/is-admin')
        .then(function(response) {
          // If backend says user isn't admin, throw an error to trigger the catch block
          if (!response.data.isAdmin) {
            throw new Error('User is not an admin');
          }
          // Resolve with admin status if valid
          return response.data.isAdmin;
        })
        .catch(function(error) {
          // Re-throw the error so the route resolve can handle it
          throw error;
        });
    }
  };
}]);

Step 2: Wire Up the Route Resolve Correctly #

In your route configuration, use the auth factory’s promise in the resolve block. The route will wait for this promise to resolve before loading the page. If the promise rejects, you can redirect the user and prevent the page from loading.

Example route config:

app.config(['$routeProvider', function($routeProvider) {
  $routeProvider
    .when('/admin-only-page', {
      templateUrl: 'admin-page.html',
      controller: 'AdminController',
      resolve: {
        // This key will hold the resolved admin status (or trigger rejection)
        adminValidation: ['AuthFactory', '$location', '$q', function(AuthFactory, $location, $q) {
          return AuthFactory.verifyAdminAccess()
            .then(function(isAdmin) {
              // If valid, return the status to pass to the controller (optional)
              return isAdmin;
            })
            .catch(function(error) {
              console.error('Admin access denied:', error);
              // Redirect to login or a non-admin page
              $location.path('/login');
              // Return a rejected promise to stop the route from loading
              return $q.reject(error);
            });
        }]
      }
    });
}]);

Key Things to Double-Check #

• Always return the promise chain: If you forget to return AuthFactory.verifyAdminAccess() or the .then() chain in your resolve function, the route won’t wait for the async operation to finish.
• Handle rejection properly: When validation fails, make sure to reject the promise (either by throwing an error in the factory or returning $q.reject() in the resolve). This tells Angular to abort loading the current route.
• Avoid synchronous checks: If your auth factory was doing a synchronous check (like just checking a local variable), wrap it in a promise anyway to keep the logic consistent and ensure the route waits.

Simplified Alternative (If You Don’t Need Controller Access to the Result) #

If you don’t need to pass the admin status to the controller, you can simplify the resolve block even further:

resolve: {
  adminValidation: ['AuthFactory', '$location', function(AuthFactory, $location) {
    return AuthFactory.verifyAdminAccess()
      .catch(function() {
        $location.path('/login');
        // Reject to block route loading
        return $q.reject();
      });
  }]
}

This setup ensures the page will only load if the admin check completes successfully. Any failure (whether API error or non-admin user) will redirect the user and prevent the restricted page from loading.

内容的提问来源于stack exchange，提问作者Morgan Hayes