Skip to content

Conversation

EliuX
Copy link
Contributor

@EliuX EliuX commented Apr 17, 2020

In this PR we make possible change the model of the time entries, so that it is checked that the current user can only manipulate time entry items where he is the owner, otherwise he will get an 403 error:
image

This is possible because of the new parameter peeker and conditions:

  • peeker: It is a peeker that is meant to watch the item that is manipulated and if a biz-logic criteria requirement is not fulfilled it can short-circuit the user request flow by raising an CustomError.
  • conditions: It is a python dictionary that contains the attribute and the corresponding expected value we expect the entries have in the database. This is done by creating an equality condition in the where clause of the SQL query executed in the function find_all.

Copy link
Contributor

@Angeluz-07 Angeluz-07 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good Job.

@EliuX EliuX force-pushed the feature/Make-sure-users-access-their-time-entries#82 branch from e4185b4 to 3c2e9da Compare April 20, 2020 19:51
@EliuX EliuX merged commit ec4b4de into master Apr 20, 2020
@EliuX EliuX deleted the feature/Make-sure-users-access-their-time-entries#82 branch April 20, 2020 21:29
@EliuX EliuX self-assigned this Apr 28, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants