amplication / amplication/amplication
As a User - I want my generated code to use the best practices on ACLs in Nestjs
- Ngôn ngữ chính
- TypeScript
- Star
- 16k
- Fork
- 1.5k
- Chỉ số merge pull request
- Không có pull request nào được merge trong 30 ngày
Mô tả
At the moment, the generated code uses `AclValidateRequestInterceptor` and `AclFilterResponseInterceptor` to validate user permissions on entities and fields.
As per NestJs best practices, we should use Guards instead as they are meant for authentication, roles permissions and ACLs.
Guards are also run before any interceptor, pipe or filters, releasing the server from useless tasks.
https://docs.nestjs.com/faq/request-lifecycle#summary
## `AclValidateRequestInterceptor`
Should be migrated to a Guard
## `AclFilterResponseInterceptor`
This interceptor is conceptually wrong since it change the behaviour of the results on the basis of user permissions.
As best practices, the response to a request should contain either the expected result of an error stating the missing permissions.
i.e.
on a request for a client that has read permissions only on user name like
```graphql
query user {
name
email
}
```
current result doesn't let the client that it did not have access to email
```graphql
data: {
user: {
name
}
}
```
expected result will look something like this
```graphql
data: {
user: {
name
}
},
errors: [
{
"message": "Unauthorized to access user.email "
// ...additional fields...
}
]
```
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.