New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Expand authorization validation for Project CRUD operations #328

Merged

entrotech merged 1 commit into develop from claire

Apr 1, 2020

Member

nclairesays commented Mar 31, 2020 •

edited

Loading

closes #309
added backend logic to check if the requester of a PUT, POST, or DELETE request is an authorized user of that project or an admin user

previously, you could create or delete a project with anybody's login id via postman if you add their loginId in the request body
now, it checks to make sure that the loginId in the request body is the same as the user's id who is logged and if the user is an admin for PUT, POST, and DELETE
I also updated existing delete path to include /:id params

Refactor/Code Cleanup: deleted unused files (playground and auth.service.js)

Related issues:
#302
#275 (which is only related to view access)


          Expand authorization validation for Project CRUD operations

0241a87

nclairesays force-pushed the claire branch from f181635 to 0241a87 Compare

March 31, 2020 07:31

entrotech merged commit a47cb3e into develop

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet