In my management system, users can register and manage the platform using CRUD operations. I want to restrict the privilege of adding, updating, and deleting other users only to the admin role. If a user is not an admin, they should only be able to use the search function. However, the currentAccount (active user) stored in sessionStorage lacks information about the user's role:
{id: 1, password: "111111", type: "0", userName: "admin"}There is no indication of the user's role included in the current storage setup as shown here:
(user.type === "0" ? "Normal User" : "Administrator")public class User implements Serializable {
private int id;
private String userName;
private String password;
private String type;
----------
----------
----------
----------
}
The structure of my add function is as follows:
function addUser() {
popWindow("add_user.html", "add user");
}
This is how my delete function is set up:
function deleteUser(id) {
let form = document.querySelector("#queryForm");
let formData = new FormData(form);
formData.append("action", DELETE);
formData.append("ids", id);
sendPost("/SMS/user", formData2Url(formData), handleDelete);
}
function handleDelete() {
search();
}
function search() {
let form = document.querySelector("#queryForm");
let formData = new FormData(form);
formData.append("action", QUERY);
sendPost("/SMS/user", formData2Url(formData), handleQuery);
}
Here is how my update function is structured:
function updateUser(user) {
sessionStorage.setItem("user2Delete", JSON.stringify(user));
popWindow("update_user.html", "update user");
}
I am considering iterating through a list of users, locating the user within the currentAccount object, and retrieving their type. However, this approach does not seem effective. Is there a more optimal method to achieve this?