simple rbac for stronger health route protection

src/app/home/home-router.module.ts

@@ -34,8 +34,8 @@ const routes: Routes = [
       { path: 'upgrade/myplanet', component: UpgradeComponent, data: { myPlanet: true } },
       { path: 'teams', loadChildren: () => import('../teams/teams.module').then(m => m.TeamsModule) },
       { path: 'enterprises', loadChildren: () => import('../teams/teams.module').then(m => m.TeamsModule), data: { mode: 'enterprise' } },
-      { path: 'health', component: HealthListComponent },
-      { path: 'health/profile/:id', loadChildren: () => import('../health/health.module').then(m => m.HealthModule) },
+      { path: 'health', component: HealthListComponent, data: { roles: [ '_admin', 'health' ] } },
+      { path: 'health/profile/:id', loadChildren: () => import('../health/health.module').then(m => m.HealthModule), data: { roles: [ '_admin', 'health' ] } },
       { path: 'nation', component: TeamsViewComponent, data: { mode: 'services' } },
       { path: 'earth', component: TeamsViewComponent, data: { mode: 'services' } },
       { path: myDashboardRoute, component: DashboardComponent },

src/app/shared/auth-guard.service.ts

@@ -22,12 +22,17 @@ export class AuthService {
     return this.pouchAuthService.getSessionInfo();
   }
 
-  private checkUser(url: any): Observable<boolean> {
+  private checkUser(url: any, roles: any[]): Observable<boolean> {
     return this.getSession$().pipe(
       switchMap((sessionInfo) => {
         if (sessionInfo.userCtx.name) {
           // If user already matches one on the user service, do not make additional call to CouchDB
-          if (sessionInfo.userCtx.name === this.userService.get().name) {
+          const user = this.userService.get();
+          if (sessionInfo.userCtx.name === user.name) {
+            if (roles.length > 0) {
+              const hasRole = roles.some(role => user.roles.includes(role));
+              return hasRole ? of(true) : of(false);
+            }
             return of(true);
           }
           this.stateService.requestBaseData();
@@ -46,15 +51,14 @@ export class AuthService {
   // change if session has expired
   canActivateChild(route: ActivatedRouteSnapshot, state: RouterStateSnapshot): Observable<boolean> {
     let currentRoute: ActivatedRouteSnapshot | null = route;
-
+    const roles: Array<string> = currentRoute.data?.roles ?? [];
     while (currentRoute) {
       if (currentRoute.data && currentRoute.data.requiresAuth === false) {
         return of(true);
       }
       currentRoute = currentRoute.parent;
     }
-
-    return this.checkUser(state.url);
+    return this.checkUser(state.url, roles);
   }
 
   // For login route will redirect to main app if there is an active session