feat(forums): add forums server policy & routes

modules/forums/server/policies/forums.server.policy.js

@@ -0,0 +1,64 @@
+'use strict';
+
+/**
+ * Module dependencies
+ */
+var acl = require('acl');
+
+// Using the memory backend
+acl = new acl(new acl.memoryBackend());
+
+/**
+ * Invoke Invitations Permissions
+ */
+exports.invokeRolesPolicies = function () {
+  acl.allow(
+    [
+      {
+        roles: ['admin', 'oper'],
+        allows: [
+          {resources: '/api/forums', permissions: '*'},
+          {resources: '/api/forums/:forumId', permissions: '*'}
+        ]
+      },
+      {
+        roles: ['user'],
+        allows: [
+          {resources: '/api/forums', permissions: ['get']},
+          {resources: '/api/forums/:forumId', permissions: ['get']}
+        ]
+      },
+      {
+        roles: ['guest'],
+        allows: [
+          {resources: '/api/forums', permissions: ['get']},
+          {resources: '/api/forums/:forumId', permissions: ['get']}
+        ]
+      }
+    ]
+  );
+};
+
+/**
+ * Check If Invitations Policy Allows
+ */
+exports.isAllowed = function (req, res, next) {
+  var roles = (req.user) ? req.user.roles : ['guest'];
+
+  // Check for user roles
+  acl.areAnyRolesAllowed(roles, req.route.path, req.method.toLowerCase(), function (err, isAllowed) {
+    if (err) {
+      // An authorization error occurred
+      return res.status(500).send('Unexpected authorization error');
+    } else {
+      if (isAllowed) {
+        // Access granted! Invoke next middleware
+        return next();
+      } else {
+        return res.status(403).json({
+          message: 'User is not authorized'
+        });
+      }
+    }
+  });
+};

modules/forums/server/routes/forums.server.routes.js

@@ -0,0 +1,22 @@
+'use strict';
+
+/**
+ * Module dependencies
+ */
+var forumsPolicy = require('../policies/forums.server.policy'),
+  forums = require('../controllers/forums.server.controller');
+
+module.exports = function (app) {
+  // Articles collection routes
+  app.route('/api/forums').all(forumsPolicy.isAllowed)
+    .get(forums.list)
+    .post(forums.create);
+
+  // Single article routes
+  app.route('/api/forums/:forumId').all(forumsPolicy.isAllowed)
+    .put(forums.update)
+    .delete(forums.delete);
+
+  // Finish by binding the article middleware
+  app.param('forumId', forums.forumByID);
+};