@stonyx/orm 0.3.2-alpha.116 → 0.3.2-alpha.117
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -821,8 +821,10 @@ beforeHook('delete', 'animal', (context) => {
|
|
|
821
821
|
const user = context.state.currentUser;
|
|
822
822
|
const animal = store.get('animal', context.request.recordId);
|
|
823
823
|
|
|
824
|
-
// `animal.owner` is the related Record, so compare its id
|
|
825
|
-
|
|
824
|
+
// `animal.owner` is the related Record, so compare its id. Refuse an unowned
|
|
825
|
+
// animal outright: `animal.owner?.id !== user.id` lets a user with no id
|
|
826
|
+
// delete it, because `undefined !== undefined` is false
|
|
827
|
+
if (!user.isAdmin && (!animal.owner || animal.owner.id !== user.id)) {
|
|
826
828
|
return 403; // Forbidden
|
|
827
829
|
}
|
|
828
830
|
});
|