fix: user profile not deleted without "Manage User Access" permission gf-449 #478
Conversation
Vitaliistf
requested review from
liza-veis,
what1s1ove and
yevhenii-hladkov
as code owners
| const resourceId = (params as { id?: string }).id; | ||
| const isUsersRoute = url.includes(APIPath.USERS); | ||
| const isCurrentUserRoute = isUsersRoute && Number(resourceId) === user.id; | ||
|
|
||
| if (isCurrentUserRoute) { | ||
| done(); | ||
|
|
||
| return; | ||
| } |
There was a problem hiding this comment.
This logic shouldn't be in checkUserPermissions hook. This hook is for common permission case and should now nothing about specific routes and their logic. Instead let's use DELETE /authenticated-user and PATCH /authenticated-user in auth controller for current user, and move the logic related to this routes to auth module
There was a problem hiding this comment.
Actually let's do it simpler and user DELETE /users, PATCH /users to update or delete current user
There was a problem hiding this comment.
So, you mean, user that wants to delete/update his own account now should send a request without id, and the admin that wants to delete other user should use id (permissions will be checked of course), right?
Added logic to handle user self-accessing activity to the check user permissions hook.