diff --git a/packages/component-invite/config/authsome-mode.js b/packages/component-invite/config/authsome-mode.js index 3498bc042c01679ecc1e75f8a783628e63cd153c..762998f83e80d5e678595bb8bf7e57072607adbe 100644 --- a/packages/component-invite/config/authsome-mode.js +++ b/packages/component-invite/config/authsome-mode.js @@ -102,6 +102,13 @@ async function authenticatedUser(user, operation, object, context) { } } + if ( + operation === 'POST' && + object.path === '/collections/:collectionId/fragments' + ) { + return true + } + // Allow the authenticated user to GET collections they own if (operation === 'GET' && object === '/collections/') { return { @@ -183,7 +190,7 @@ async function authenticatedUser(user, operation, object, context) { return false } - if (user.teams.length !== 0) { + if (user.teams.length !== 0 && operation === 'GET') { const permissions = await teamPermissions(user, operation, object, context) if (permissions) { diff --git a/packages/component-manuscript-manager/config/authsome-mode.js b/packages/component-manuscript-manager/config/authsome-mode.js index 3498bc042c01679ecc1e75f8a783628e63cd153c..762998f83e80d5e678595bb8bf7e57072607adbe 100644 --- a/packages/component-manuscript-manager/config/authsome-mode.js +++ b/packages/component-manuscript-manager/config/authsome-mode.js @@ -102,6 +102,13 @@ async function authenticatedUser(user, operation, object, context) { } } + if ( + operation === 'POST' && + object.path === '/collections/:collectionId/fragments' + ) { + return true + } + // Allow the authenticated user to GET collections they own if (operation === 'GET' && object === '/collections/') { return { @@ -183,7 +190,7 @@ async function authenticatedUser(user, operation, object, context) { return false } - if (user.teams.length !== 0) { + if (user.teams.length !== 0 && operation === 'GET') { const permissions = await teamPermissions(user, operation, object, context) if (permissions) { diff --git a/packages/xpub-faraday/config/authsome-mode.js b/packages/xpub-faraday/config/authsome-mode.js index 3498bc042c01679ecc1e75f8a783628e63cd153c..762998f83e80d5e678595bb8bf7e57072607adbe 100644 --- a/packages/xpub-faraday/config/authsome-mode.js +++ b/packages/xpub-faraday/config/authsome-mode.js @@ -102,6 +102,13 @@ async function authenticatedUser(user, operation, object, context) { } } + if ( + operation === 'POST' && + object.path === '/collections/:collectionId/fragments' + ) { + return true + } + // Allow the authenticated user to GET collections they own if (operation === 'GET' && object === '/collections/') { return { @@ -183,7 +190,7 @@ async function authenticatedUser(user, operation, object, context) { return false } - if (user.teams.length !== 0) { + if (user.teams.length !== 0 && operation === 'GET') { const permissions = await teamPermissions(user, operation, object, context) if (permissions) {