@appsemble/node-utils
Version:
NodeJS utilities used by Appsemble internally.
52 lines • 2.1 kB
JavaScript
import { assertKoaCondition } from '@appsemble/node-utils';
import { appWideGroupId, getGroupIdWhere } from '../../../../utils/resources.js';
export function createDeleteAppResourceController(options) {
return async (ctx) => {
const { pathParams: { appId, resourceId, resourceType }, queryParams: { selectedGroupId }, user: authSubject, } = ctx;
const { checkAppPermissions, deleteAppResource, getApp, getAppResource } = options;
const app = await getApp({
context: ctx,
query: { attributes: ['demoMode', 'id'], where: { id: appId } },
});
const findOptions = {
where: {
id: resourceId,
type: resourceType,
GroupId: getGroupIdWhere(selectedGroupId),
expires: { or: [{ gt: new Date() }, { eq: null }] },
...(app.demoMode ? { seed: false, ephemeral: true } : {}),
},
};
const resource = await getAppResource({
app,
id: resourceId,
type: resourceType,
context: ctx,
findOptions,
});
assertKoaCondition(resource != null, ctx, 404, 'Resource not found');
// The resource is searched across the selected groups; authorization is
// then scoped to the group the resource actually belongs to.
await checkAppPermissions({
context: ctx,
permissions: [
resource.$author?.id === authSubject.id
? `$resource:${resourceType}:own:delete`
: `$resource:${resourceType}:delete`,
],
app,
groupId: resource.$group?.id ?? appWideGroupId,
});
await deleteAppResource({
app,
context: ctx,
id: resourceId,
type: resourceType,
options,
lockWhere: findOptions.where,
ifMatch: ctx.get('If-Match') || undefined,
});
ctx.status = 204;
};
}
//# sourceMappingURL=createDeleteAppResourceController.js.map