fix author access

packages/xpub-faraday/config/authsome-helpers.js

@@ -60,12 +60,7 @@ const filterObjectData = (
   return object
 }
 
-const getTeamsByPermissions = async (
-  teamIds = [],
-  permissions,
-  TeamModel,
-  object,
-) => {
+const getTeamsByPermissions = async (teamIds = [], permissions, TeamModel) => {
   const teams = await Promise.all(
     teamIds.map(async teamId => {
       const team = await TeamModel.find(teamId)

packages/xpub-faraday/config/authsome-mode.js

@@ -9,7 +9,6 @@ async function teamPermissions(user, operation, object, context) {
     user.teams,
     permissions,
     context.models.Team,
-    object,
   )
 
   let collectionsPermissions = await Promise.all(
@@ -20,8 +19,12 @@ async function teamPermissions(user, operation, object, context) {
         permission: team.teamType.permissions,
       }
       const objectType = get(object, 'type')
-      if (objectType === 'fragment' && collection.fragments.includes(object.id))
-        collPerm.fragmentId = object.id
+      if (objectType === 'fragment') {
+        if (collection.fragments.includes(object.id))
+          collPerm.fragmentId = object.id
+        else return null
+      }
+
       if (objectType === 'collection')
         if (object.id !== collection.id) return null
       return collPerm
@@ -111,13 +114,6 @@ async function authenticatedUser(user, operation, object, context) {
     return true
   }
 
-  // Allow the authenticated user to GET collections they own
-  if (operation === 'GET' && object === '/collections/') {
-    return {
-      filter: collection => collection.owners.includes(user.id),
-    }
-  }
-
   if (operation === 'GET' && get(object, 'type') === 'collection') {
     if (object.owners.includes(user.id)) return true
     const owner = object.owners.find(own => own.id === user.id)
@@ -216,18 +212,18 @@ async function authenticatedUser(user, operation, object, context) {
     }
   }
 
-  if (get(object, 'type') === 'collection') {
-    if (['GET', 'DELETE'].includes(operation)) {
-      return true
-    }
-
-    // Only allow filtered updating (mirroring filtered creation) for non-admin users)
-    if (operation === 'PATCH') {
-      return {
-        filter: collection => omit(collection, 'filtered'),
-      }
-    }
-  }
+  // if (get(object, 'type') === 'collection') {
+  //   if (['GET', 'DELETE'].includes(operation)) {
+  //     return true
+  //   }
+
+  //   // Only allow filtered updating (mirroring filtered creation) for non-admin users)
+  //   if (operation === 'PATCH') {
+  //     return {
+  //       filter: collection => omit(collection, 'filtered'),
+  //     }
+  //   }
+  // }
 
   // A user can GET, DELETE and PATCH itself
   if (get(object, 'type') === 'user' && get(object, 'id') === user.id) {