fix authsome

packages/component-invite/config/authsome-mode.js

@@ -102,6 +102,13 @@ async function authenticatedUser(user, operation, object, context) {
     }
   }
 
+  if (
+    operation === 'POST' &&
+    object.path === '/collections/:collectionId/fragments'
+  ) {
+    return true
+  }
+
   // Allow the authenticated user to GET collections they own
   if (operation === 'GET' && object === '/collections/') {
     return {
@@ -183,7 +190,7 @@ async function authenticatedUser(user, operation, object, context) {
     return false
   }
 
-  if (user.teams.length !== 0) {
+  if (user.teams.length !== 0 && operation === 'GET') {
     const permissions = await teamPermissions(user, operation, object, context)
 
     if (permissions) {

packages/component-manuscript-manager/config/authsome-mode.js

@@ -102,6 +102,13 @@ async function authenticatedUser(user, operation, object, context) {
     }
   }
 
+  if (
+    operation === 'POST' &&
+    object.path === '/collections/:collectionId/fragments'
+  ) {
+    return true
+  }
+
   // Allow the authenticated user to GET collections they own
   if (operation === 'GET' && object === '/collections/') {
     return {
@@ -183,7 +190,7 @@ async function authenticatedUser(user, operation, object, context) {
     return false
   }
 
-  if (user.teams.length !== 0) {
+  if (user.teams.length !== 0 && operation === 'GET') {
     const permissions = await teamPermissions(user, operation, object, context)
 
     if (permissions) {

packages/xpub-faraday/config/authsome-mode.js

@@ -102,6 +102,13 @@ async function authenticatedUser(user, operation, object, context) {
     }
   }
 
+  if (
+    operation === 'POST' &&
+    object.path === '/collections/:collectionId/fragments'
+  ) {
+    return true
+  }
+
   // Allow the authenticated user to GET collections they own
   if (operation === 'GET' && object === '/collections/') {
     return {
@@ -183,7 +190,7 @@ async function authenticatedUser(user, operation, object, context) {
     return false
   }
 
-  if (user.teams.length !== 0) {
+  if (user.teams.length !== 0 && operation === 'GET') {
     const permissions = await teamPermissions(user, operation, object, context)
 
     if (permissions) {