Update team and collection authorization

2018-02-18 01:14:51 -08:00
parent 2f81eb5e87
commit e84fb5e6ba
17 changed files with 181 additions and 135 deletions
--- a/server/policies/user.js
+++ b/server/policies/user.js
@ -0,0 +1,29 @@
+// @flow
+import policy from './policy';
+import User from '../models/User';
+
+const { allow } = policy;
+
+allow(
+  User,
+  'read',
+  User,
+  (actor, user) => user && user.teamId === actor.teamId
+);
+
+allow(
+  User,
+  ['update', 'delete'],
+  User,
+  (actor, user) =>
+    user &&
+    user.teamId === actor.teamId &&
+    (user.id === actor.id || actor.isAdmin)
+);
+
+allow(
+  User,
+  ['promote', 'demote'],
+  User,
+  (actor, user) => user && user.teamId === actor.teamId && actor.isAdmin
+);