identity/openrecord/permissions/update.js

Identity client

module.exports = {
  beforeUpdate: function(){
    var self = this;
  
    return function(){
      if(!this.context) return true;

      //check if a create is allowed in general
      var callbacks = self.getTypeCallbacks(this.context, 'update');

      if(callbacks.indexOf(true) === -1){
        var allowed = false;
        
        for(var i = 0; i < callbacks.length; i++){
          if(typeof callbacks[i] == 'function'){
            if(callbacks[i].call(this, this)){
              allowed = true;
              break;
            }
          }
        }
        
        if(!allowed){
          this.errors.add(self.errors.insufficient_permissions);
          return false;
        }
      }
      
      //check all allowed attributes
      this._allowed_attributes = this.allowed_attributes;
      this.allowed_attributes = self.getAllowedAttributes(this, 'update');

      return true;
    }
  }
};