Conditionally guarding routes in the front-end?

jackdcrawley

We are building a bespoke forum in Flarum that must be inaccessible until a specific condition is met in the user model. While this condition isn't met, any HTTP requests are redirected to a route we have set up. However, the rest of the SPA is still accessible when links within it are clicked, which we don't want to be possible.

We currently have a custom middleware set up which redirects to a custom view in the SPA when entered in the URL, but due to the nature of the application, links can still be followed and the rest of the forum can still be accessed.

Is there a way to block routes in the front-end based on a condition in the user model?

clarkwinkelmann

jackdcrawley you could extend the init method of the Flarum Page component, and trigger the navigation to another page in there.

Maybe there's a way to go directly inside Mithril routing to perform it even sooner in the navigation lifecyle. But to my knowledge Mithril doesn't have any concept of redirections in their routing system. You will have to let the intended page load, then trigger a page change from that page.

Because some routes are created through functions, you could replace those to link directly to your new page. For example app.route.discussion() is used to create the links to discussion. You could override it to always return app.route('yourroutename'). You could maybe even replace app.route() itself to return another url. This might not replace all links (some might be hard-coded) but would probably cover a good number of links from the homepage.

zyronix

It's important to note that any data you are trying to safeguard should never be relied solely on the front-end for protection from. Can you not restrict the content using Flarum's existing group/tag permission settings?

Can you be a little more specific on what challenges you are facing, as the description here is a little vague. A frontend block will never prevent the backend from serving the data in question. It's still a necessity, but mainly for cosmetic reasons.

clarkwinkelmann

zyronix as mentioned here https://discuss.flarum.org/d/22563-extension-javascript-navigation-route-guards and on Discord (not sure if the authors were the same person), it's easy to block access to Flarum by giving users the Guest role in the backend. That's how the Suspend, Terms and email confirmation work in Flarum.

Once the user has been given the Guest role, they are effectively browsing the forum like if they were logged out, and can't perform any action. Javascript can then be used to enhance the experience to redirect users or let them know why they are blocked.

I was assuming the OP already implemented that part.

Relying only on middlewares for protection might indeed not suffice. It's best to restrict permissions at the policies level, which is what the Guest role does.

zyronix

clarkwinkelmann I agree and understand the approach, just wanted to make sure OP is aware they'll need more than a javascript block. My only issue with setting users as guest as it serves as a site-wide block, and if you're only restricting a part of the forum that method becomes less feasible.