Open alaboudi opened 7 years ago
I'm using something like this:
resources:['someResource'],
permissions:['owner-view','other-view','owner-update','other-update']
and in controllers before checking permissions I'm checking who wants to 'view' or 'update' something by session.userId
and then get result from db and check who is owner of the record, if session.userId==dbRecord.userId
then I'm checking 'owner-view' permissions for this user or else 'other-view' (if admin want to view record or other user)
app.put('/blogs/:id', acl.middleware(), function(req, res, next){…} Is the app in the express getting the object?
Is there any other way to allow access to resource owner ?
Hi,
Is there another way of only allowing resource owners to access a certain resource? The documentation slightly touches on this by saying
but this clutter my database and make a collection for every user? Is there no other way of achieving this?