nestjsx / crud

NestJs CRUD for RESTful APIs
https://github.com/nestjsx/crud/wiki
MIT License
4.04k stars 533 forks source link

Why replaceOne in CrudService ignore the notfound error and replace record not belong to user. #734

Open qiuzuhui opened 3 years ago

qiuzuhui commented 3 years ago

Currently I'm using CrudAuth to fitler the resource belong to user as following: @CrudAuth({ property: 'user', filter: (user) => { console.log(user.id); return { ownerId: user.id, }; }, persist: (user) => ({ ownerId: user.id }), })

When i send a PUT request to update a resource which is belong to another user. (supposed it will return not found ), but it replace the record which it not belong to this user.

https://github.com/nestjsx/crud/blob/bbea082a3f0fc7c1be42a79164f41b8449ad2251/packages/crud-typeorm/src/typeorm-crud.service.ts#L215

Here ignored the NotFound error ( belong to other user ) and save record.

ebastidas commented 1 year ago

I have the same issue, @michaelyali what is the purpose of using library "@zmotivat0r/o0"? Would it be ok to replace this line:

https://github.com/nestjsx/crud/blob/43cf6658bc245101ea79eb70360ec3b78894f2cb/packages/crud-typeorm/src/typeorm-crud.service.ts#L203

to something like the code in the "updateOne" which throws the "Not Found" error when the resource doesn't belong to the user? Like here:

https://github.com/nestjsx/crud/blob/43cf6658bc245101ea79eb70360ec3b78894f2cb/packages/crud-typeorm/src/typeorm-crud.service.ts#L168