我正在从本教程视频中学习mean.io，它显示了示例包（由 . 创建。它也在文档的“包”下进行了描述）。我想帮助理解给定的身份验证/授权是如何工作的。mean package mymodule
默认示例包/模块在客户端具有简单的用户身份验证
myapp/packages/mymodule/public/views/index.html包含：
<li>
<a href="mymodule/example/anyone">Server route that anyone can access</a>
</li>
<li>
<a href="mymodule/example/auth">Server route that requires authentication</a>
</li>
<li>
<a href="mymodule/example/admin">Server route that requires admin user</a>
</li>
在服务器端，
myapp/packages/mymodule/server/routes/mymodule.js，包含：
// The Package is past automatically as first parameter
module.exports = function(Mymodule, app, auth, database) {
app.get('/mymodule/example/anyone', function(req, res, next) {
res.send('Anyone can access this');
});
app.get('/mymodule/example/auth', auth.requiresLogin, function(req, res, next) {
res.send('Only authenticated users can access this');
});
app.get('/mymodule/example/admin', auth.requiresAdmin, function(req, res, next) {
res.send('Only users with Admin role can access this');
});
...
};
不同身份验证的魔力依赖于app.get()带有附加身份验证回调的第二个参数：无auth.requiresLogin、或auth.requiresAdmin。
这是身份验证魔法（也在github 上）：
myapp/packages/access/server/config/authorization.js：
/**
* Generic require login routing middleware
*/
exports.requiresLogin = function(req, res, next) {
if (!req.isAuthenticated()) {
return res.send(401, 'User is not authorized');
}
next();
};
/**
* Generic require Admin routing middleware
* Basic Role checking - future release with full permission system
*/
exports.requiresAdmin = function(req, res, next) {
if (!req.isAuthenticated() || !req.user.hasRole('admin')) {
return res.send(401, 'User is not authorized');
}
next();
};
问题 A：为什么在 authorization.js 中是“exports.requiresLogin”和“exports.requiresAdmin”而不是“somethingelse.requiresLogin”和“somethingelse.requiresAdmin”？ 这是与myapp/packages/access/server/config/passport.js的exports: module.exports = function(passport) { ...}、github相关的“导出”吗？如果是这样，在什么情况下我们可以使用这个“出口”？
由于身份验证的授权规则写在包“access”中并在包“mymodule”中使用，Mean.io 包之间不是相互独立的。Access包裹注册于
myapp/packages/access/app.js，github：
var mean = require('meanio'),
Module = mean.Module,
passport = require('passport');
var Access = new Module('access');
Access.register(function(database) {
// Register auth dependency
var auth = require('./server/config/authorization');
require('./server/config/passport')(passport);
// This is for backwards compatibility
mean.register('auth', function() {
return auth;
});
mean.register('passport', function() {
return passport;
});
Access.passport = passport;
Access.middleware = auth;
return Access;
});
问题 B：Mean.io 是否会自动链接所有包，或者是否有代码将包链接到某个地方？它是否由于下面显示的“这是为了向后兼容”的部分而链接的？如果是这样，“auth”可以在哪里使用？所有包myapp/packages/？在 mean.io 基础应用程序目录myapp/中怎么样？
var auth = require('./server/config/authorization');
// This is for backwards compatibility
mean.register('auth', function() {
return auth;
});
问题 C：为什么它是“Access.passport = passport;”，但“Access.middleware = auth;”是“中间件”？如果它是“Access.auth = auth”会发生什么？