node.js - sailsjs policy causing Can't set headers after they are sent error

Question

I have this policy that basically checks a users access to an object before allowing them to do anything with it. So, does user 1 have access to event 4 in order to /event/edit/4 kind of thing.

I tried creating a policy (I've edited the top part, so if there are errors in this, trust me that it runs the return res.direct when it's supposed to) but when it hit's the right condition the sails process dies with an error of "Can't set headers after they are sent."

I took out another policy that was being triggered to see if it was doing anything, but it didn't change anything. Here's my policy:

module.exports = function(req, res, ok) {
    MyObj.find(req.param('id'))
        .exec(function getObjects(err, objects){
            if (objects[0]["parent"]["user"] != req.session.User.id) {  
                req.session.flash = {
                    err: "woops!"
                }
                return res.redirect('/');
            }
        });

    res.locals.flash = {};
    if(!req.session.flash) return ok();
    res.locals.flash = _.clone(req.session.flash);
    req.session.flash = {};
    return next();
};

I've also tried return res.forbidden('You are not permitted to perform this action.') instead of the res.redirect. Not that it would make a difference, but I had to factor out that I was doing the wrong thing there.

Anyone see why it would give me that error?

Answer 1

The issue is that your find is an asynchronous operation. Meaning that first, find() will trigger, then the rest of your middleware function will run including return next(). After which your find() will return and trigger res.redirect(), hence causing the error. You need to structure your code so that all of it is inside the callback:

module.exports = function(req, res, ok) {
    MyObj.find(req.param('id'))
        .exec(function getObjects(err, objects){
            if (objects[0]["parent"]["user"] != req.session.User.id) {  
                req.session.flash = {
                    err: "woops!"
                }
                return res.redirect('/');
            }

            res.locals.flash = {};
            if(!req.session.flash) return ok();
            res.locals.flash = _.clone(req.session.flash);
            req.session.flash = {};
            return next();

        });
};