rfc: add single place for defining page authorization checks #908
Conversation
| Target extends Targeted<Capability> = Targeted<Capability>, | ||
| >( | ||
| page: T, | ||
| userId: UsersId, |
There was a problem hiding this comment.
Since this is always called in a context where we've already retrieved the full user row, it would be nice to make this function accept a User here and then check user.isSuperAdmin before making the capabilities query. I miss my superadmin privileges in communities I'm not a member of 😄
| apiTokens: Capabilities.editCommunity, | ||
| docs: Capabilities.editCommunity, | ||
| apiDocs: [Capabilities.editCommunity, Capabilities.viewPub], | ||
| } as const satisfies PageAuthorizationCheckMap; |
There was a problem hiding this comment.
I agree, this is much nicer than what we've been doing!
|
I'm not sure how I feel about this approach. On one hand, it does keep the page checks very concise, but it adds ~200 lines of code to do so. What about something like this? await pageCheck(
Capabilities.editCommunity,
community.id, // infers that this must be a community id from the provided capability
user.id, // or a user object
)And just like |
Issue(s) Resolved
High-level Explanation of PR
Test Plan
Screenshots (if applicable)
Notes