Guest role added to State doesn't allow guest access

[mleanos]

When adding the guest role to any client route's data.roles array, it doesn't have any effect on the resolving of that route; the route is inaccessible to the unauthenticated user.

To reproduce, just add the following to this route config articles.client.routes

data: {
  roles: ['guest']
}

Currently, this route is accessible to unauthenticated user because of how the core client app init $stateChangeStart is working.

It doesn't take into account that when the toState.data.roles has length, but there's no authenticated user. It just continues processing and never checks for guest access.

I realize that if a client route has guest access, then the data.roles probably wouldn't have any other roles defined; and most likely, it would not have this setting on the route. However, this is still a bug because of the intended use of data.roles is to allow complete flexibility,& the developer should have complete control.

One should be able to define a client route with data.roles = ['user', 'admin', 'guest'], or any combination that suits their needs.

The simple fix is to add || role === 'guest' to the $stateChangeStart code like so, and should satisfy this bug..

var allowed = false;
  toState.data.roles.forEach(function (role) {
  if ((Authentication.user.roles !== undefined && Authentication.user.roles.indexOf(role) !== -1) || (role === 'guest')) {
    allowed = true;
    return true;
  }
});