joe/kami-parse-server
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adds support for read-only masterKey (#4297)

Browse Source 
* Adds support for read-only masterKey

* Adds tests to make sure all endpoints are properly protected

* Updates readme

* nits
This commit is contained in:
Florent Vilmart
2017-10-26 15:35:07 -04:00
committed by GitHub
parent 87b79cedfa
commit 1dd58b7527
13 changed files with 195 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/Routers/SchemasRouter.js
View File

@@ -34,6 +34,9 @@ function getOneSchema(req) {
}
function createSchema(req) {
if (req.auth.isReadOnly) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'read-only masterKey isn\'t allowed to create a schema.');
}
if (req.params.className && req.body.className) {
if (req.params.className != req.body.className) {
return classNameMismatchResponse(req.body.className, req.params.className);
@@ -51,6 +54,9 @@ function createSchema(req) {
}
function modifySchema(req) {
if (req.auth.isReadOnly) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'read-only masterKey isn\'t allowed to update a schema.');
}
if (req.body.className && req.body.className != req.params.className) {
return classNameMismatchResponse(req.body.className, req.params.className);
}
@@ -64,6 +70,9 @@ function modifySchema(req) {
}
const deleteSchema = req => {
if (req.auth.isReadOnly) {
throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'read-only masterKey isn\'t allowed to delete a schema.');
}
if (!SchemaController.classNameIsValid(req.params.className)) {
throw new Parse.Error(Parse.Error.INVALID_CLASS_NAME, SchemaController.invalidClassNameMessage(req.params.className));
}