Closed AryanshSourcefuse closed 3 months ago
@AryanshSourcefuse are you using UserModifiableRepository as base class for your repository ? If not, then you need to do that. I can see in your sandbox example, that you have not used the repo I mentioned. You need to use that for restrictions. Its mentioned in readme as well. Its similar to how softdelete works. Please fix the repository base class and then check.
Sorry, I was not able to find that in docs.
Is your feature request related to a problem? Please describe. If we create a model with ARC's
UserModifiableEntitiy
orBaseEntity
. I am able to update fields/columns which should not be updated from API. Example:createdOn
,createdBy
,modifiedOn
,modifiedBy
,deletedOn
,deletedBy
Right now, there's no safe guard for modification, if I make an API call with the above fields in request body, then those are getting updated in DB. So, any authenticated user can write any data on above fields like different user ids in
createdBy
,modifiedBy
,deletedBy
or different time(even past date/time) increatedOn
,modifiedOn
anddeletedOn
Describe the solution you'd like Fields like
createdOn
,createdBy
,modifiedOn
,modifiedBy
,deletedOn
,deletedBy
should be calculated on backend and it's value should not be taken from API's request body.Additional context Sandbox Repo: https://github.com/AryanshSourcefuse/sandbox-sourceloop Here I created just a todo service and a todo model, then I called the
POST /todos
API to create a todo with some random dataOnce I made the API request, entry was made in the database(Refer below Screenshot)![image](https://github.com/sourcefuse/loopback4-microservice-catalog/assets/121281459/50c067fa-fad8-495d-84c3-c1234c3a8afa)