'userCanSeeProfile.js' redirect kinda limited...

[stevenrace]

While low priority, I'd like some help wrapping my head around this.

In /config/policies , 'UserCanSeeProfile is being called when accessing the User model. This works when accessing localhost:1337/user - we get redirected to /session/new to login. But if one accesses /user/show (or /edit/ /update) - a type error is thrown.

      500: TypeError: Cannot read property 'id' of undefined

[Foxandxss]

If there is no user on the session (AKA logged in) that error will show.

A guard should work, like:

if (!req.session.User) return;

at the top of the policy.