FrancisG-Massey / Capstone2016

4 stars 0 forks source link

POST/PUT requests to inactive entities should fail. #271

Open sam-hunt opened 7 years ago

sam-hunt commented 7 years ago

While ordinarily users won't be able to see anything created against an inactive entities, nor will the UI normally allow them to do this, it still doesn't make sense for the API to allow it. Also these corpse records may conflict with future records which is bad.

This includes: Posting catches to inactive traps Editing inactive traps Posting traps to inactive traplines Editing inactive traplines Posting traplines to inactive regions Editing inactive regions Editing inactive bait, trap-types or catch-types Enrolling users in inactive traplines Enrolling inactive users in traplines Setting trap bait/trap-type defaults to an inactive entity id Logging catches which reference inactive entity ids

Users are auto-logged out on deletion so no issue with inactive users doing stuff. Inactive users cannot create sessions.