search

shurcooL / reactions

Package reactions provides a reactions service definition.
MIT License
3 stars 0 forks source link

Consider doing validation checks on uri/id so it's only possible to react to reactable things that exist. #1

Closed dmitshur closed 7 years ago

dmitshur commented 8 years ago

Right now, it's possible to react to any uri/id, even if they're not reactable things. It's harmless, but seems suboptimal. It's equivalent to being able to post comments on blog posts that don't exist.

Need to think if there's some reasonable way of preventing that.

One idea so far is to always create empty reaction files for reactable things, and only allow reactions to be made if the entry already exists. Need to think about that...

Hat tip to @peggyl for finding this.

dmitshur commented 7 years ago

One idea so far is to always create empty reaction files for reactable things, and only allow reactions to be made if the entry already exists.

This is what I'll go with.

I'll be adding a List method that lists all reactions at a given URL. So it makes sense to switch a model where reactions must be created explicitly (currently, only by hand, but a method can be added in future when needed), and they do not exist if the file is not found.