uprtcl / js-uprtcl-server

Uprtcl JS web-server service provider

Home Page:http://uprtcl.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add update protection

pepoospina opened this issue · comments

commented

Add a way to check, in the uprtcl.services.updatePerspectives method, that the logged user is in the canEdit "arrays" of all the perspecties in the update batch.

Try to use DGraph logic as much as possible, maybe COUNT or something like that.

commented

I would read the canEdit or publicWrite of all the perspectives in the batch on one TX and manually check it. If the logged user can't edit one or more perspectives in the batch, block the entire process.

This is how I check for the getPerspective method that get's the whole ecosystem of a perspective
https://github.com/uprtcl/js-uprtcl-server/blob/develop/src/services/uprtcl/uprtcl.repository.ts#L993