Permissions

[MicahPotter]

I'm not seeing a way to protect certain crud endpoints. Say a user needs to update their own information, but should not have permission to update another user's info. Is there a built in way to do that?

[baptadn]

Hello @MicahPotter ! You can use the onRequest callback to plug your acl logic https://next-crud.js.org/api-docs/callbacks#onrequest

[mikerudge]

Hey @shinework

I have been trying to use the onRequest callback, and manipulating the query.

async onRequest(req, res, options?) {
    const query = req.query
    
    // Do some stuff to the query
    Object.assign(req.query, {
        where:  {...},
    });
    
    console.log(query) // The query has everything I would now expect
  
    // I now want next-crud to continue to do its thing with the manipulated query
   
    return req // Do we just return the req here? 
}

I am missing something obvious I know, but wondered if you could help with an example?

[mikerudge]

To clarify, I was looking for a way to automatically add a filter for certain models.

So I am hoping I can update the request query.where and then pass that back to the next-crud.

The req I have looks something like this:

const req = {
	baseUrl: "",
	originalUrl:
		"/api/users?where=%7B%22role%22%3A%7B%22%24eq%22%3A%22ADMIN%22%7D%7D&include=",

	params: { "0": "/api/users" },
	query: {
		where: '{"role":{"$eq":"ADMIN"}}',
		include: "",
		" nextcrud": ["users"],
	},
}

Do we need to update both the originalUrl and the query object?

[mikerudge]

Oh, sorry, looks like this is already being discussed in #44