Add user role-based check on endpoint for any submitted non-GET requests. - Githubissues

h-yung / trip-organizer

A lightweight mobile-friendly app with serverless API that keeps travel information accessible on the go, with the option to log expenses.

0 stars 0 forks source link

Add user role-based check on endpoint for any submitted non-GET requests. #5

Open h-yung opened 2 months ago

h-yung commented 2 months ago

UI:

Similar to archiving trip principle, maybe also restrict UI based on role, further preventing stray requests from non-trip-linked users with the wrong role (readOnly trip-linked, not trip-linked).
This may also be redundant/trivial after authentication changes from browser - determining whether user can send through proper auth token from their browser.

Server: any additional check? from trips object? would not make sense to accept what's passed from front end as-is.

Is back and forth inevitable for each req (no sessions persisted between serverless function call)
initial req action -> check user role and trip assoc from db -> proceed or forbid
Just separate out the auth check function and call within serverless functions?