diff --git a/packages/xpub-faraday/config/authsome-mode.js b/packages/xpub-faraday/config/authsome-mode.js index d22fb6c8a4fb2324965f57662e67db57c0e4c3c0..c54dac097298841495a2289a5f4bebb986dd01ff 100644 --- a/packages/xpub-faraday/config/authsome-mode.js +++ b/packages/xpub-faraday/config/authsome-mode.js @@ -335,11 +335,25 @@ async function applyAdminPolicy(user, operation, object, context) { } } if (operation === 'PATCH') { + if (get(object, 'current.type') === 'collection') { + return !isCollectionInStatuses(get(object, 'current'), [ + 'rejected', + 'accepted', + 'withdrawn', + ]) + } if (get(object, 'current.type') === 'fragment') { const collection = await context.models.Collection.find( get(object, 'current.collectionId'), ) - return helpers.isLastFragment(collection, get(object, 'current')) + return ( + helpers.isLastFragment(collection, get(object, 'current')) && + !isCollectionInStatuses(collection, [ + 'rejected', + 'accepted', + 'withdrawn', + ]) + ) } } return true @@ -396,6 +410,9 @@ async function applyEditorInChiefPolicy(user, operation, object, context) { } } if (operation === 'PATCH') { + if (get(object, 'current.type') === 'collection') { + return false + } if (get(object, 'current.type') === 'fragment') { return false }