mirror of
https://github.com/wekan/wekan.git
synced 2025-04-21 12:37:07 -04:00
45b662a1dd
This commit uses a new package that I need to document. It tries to solve the long-standing debate in the Meteor community about allow/deny rules versus methods (RPC). This approach gives us both the centralized security rules of allow/deny and the white-list of allowed mutations similarly to Meteor methods. The idea to have static mutation descriptions is also inspired by Facebook's Relay/GraphQL. This will allow the development of a REST API using the high-level methods instead of the MongoDB queries to do the mapping between the HTTP requests and our collections.
27 lines
472 B
JavaScript
27 lines
472 B
JavaScript
Avatars = new FS.Collection('avatars', {
|
|
stores: [
|
|
new FS.Store.GridFS('avatars'),
|
|
],
|
|
filter: {
|
|
maxSize: 72000,
|
|
allow: {
|
|
contentTypes: ['image/*'],
|
|
},
|
|
},
|
|
});
|
|
|
|
function isOwner(userId, file) {
|
|
return userId && userId === file.userId;
|
|
}
|
|
|
|
Avatars.allow({
|
|
insert: isOwner,
|
|
update: isOwner,
|
|
remove: isOwner,
|
|
download() { return true; },
|
|
fetch: ['userId'],
|
|
});
|
|
|
|
Avatars.files.before.insert((userId, doc) => {
|
|
doc.userId = userId;
|
|
});
|