On put, if you protect() every field, will wipe out entire collection

[brianhiss]

I was adding protect() to a put method, to secure a collection. I started by adding all the fields and then backing out a few fields I wanted to change. I noticed when I had all the fields in put.js listed with protect(), it wiped out every row of data in that collection.

I have been testing it several times with all different field types (array, string, number, etc.) and seems to be consistent behavior.

I am going to dig for a solution, but wanted to give a heads up if someone else experienced this or already has a solution.

Check out: [Protect in the Deployd Docs](http://docs.deployd.com/docs/collections/adding-logic.md#s-On Put-3789)

[brianhiss]

Found the solution, can't seem to submit a pull request.

Under lib/resources/collection/index.js, around line ~520, wrap this:

store.update({id: query.id}, item, function (err) {
   if(err) return done(err);
   item.id = id;

   done(null, item);

   if(session && session.emitToAll) session.emitToAll(collection.name + ':changed');
});

with this:

if (Object.keys(item).length === 0) {
            done(new Error("Not authorized."));
        } else {
            store.update({id: query.id}, item, function (err) {
                if(err) return done(err);
                item.id = id;

                done(null, item);

                if(session && session.emitToAll) session.emitToAll(collection.name + ':changed');
            });
        }
      }

[ritch]

A PR for this would be great. What was the issue when submitting one?

[sigbjornt]

It does not look like this problem is resolved (using 0.8.4).
May I suggest to reopen the issue?

Small usecase where the object lost all values except from the id:

id="";

dpd.mycollection.post({Name:'Test', theArray:[{'data':'testdata'}]}, function(result, error) {
id=result.id
});

dpd.mycollection.put(id,{Name:"updatedName", theArray:[{'data':'updated-testdata'}]});

The collection has 3 fields: id (string), Name (string) and theArray (array). The onPut event handler protects 2 fields

protect('theArray');
protect('Name')