diff --git a/packages/xpub-faraday/config/authsome-helpers.js b/packages/xpub-faraday/config/authsome-helpers.js index 39f753c539a754d22829a00a0397277236eb40b1..a828242791e6f55a399a11cc87ab0f20877390b1 100644 --- a/packages/xpub-faraday/config/authsome-helpers.js +++ b/packages/xpub-faraday/config/authsome-helpers.js @@ -37,6 +37,9 @@ const isOwner = ({ user: { id }, object }) => { return !!object.owners.find(own => own.id === id) } +const isLastFragment = (collection, fragment) => + get(fragment, 'id', '') === last(get(collection, 'fragments', [])) + const hasPermissionForObject = async ({ user, object, Team, roles = [] }) => { const userPermissions = await getUserPermissions({ user, @@ -333,6 +336,7 @@ module.exports = { parseUser, getUsersList, getCollections, + isLastFragment, isHandlingEditor, getUserPermissions, setCollectionStatus, diff --git a/packages/xpub-faraday/config/authsome-mode.js b/packages/xpub-faraday/config/authsome-mode.js index 3d9ed009ddf73659481ffe1fa92007bed066d789..936b11dea5a621130914c86cb5efc3a97bd9057a 100644 --- a/packages/xpub-faraday/config/authsome-mode.js +++ b/packages/xpub-faraday/config/authsome-mode.js @@ -325,6 +325,15 @@ async function applyAdminPolicy(user, operation, object, context) { ) } } + if (operation === 'PATCH') { + if (get(object, 'current.type') === 'fragment') { + const collection = await context.models.Collection.find( + get(object, 'current.collectionId'), + ) + const isLast = helpers.isLastFragment(collection, get(object, 'current')) + return isLast + } + } return true }