amplication / amplication/amplication

As a User - I want my generated code to use the best practices on ACLs in Nestjs

Đang mở
#6,779 2 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
TypeScript
Star
16k
Fork
1.5k
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

At the moment, the generated code uses `AclValidateRequestInterceptor` and `AclFilterResponseInterceptor` to validate user permissions on entities and fields.

As per NestJs best practices, we should use Guards instead as they are meant for authentication, roles permissions and ACLs.
Guards are also run before any interceptor, pipe or filters, releasing the server from useless tasks.
https://docs.nestjs.com/faq/request-lifecycle#summary

## `AclValidateRequestInterceptor`
Should be migrated to a Guard

## `AclFilterResponseInterceptor`

This interceptor is conceptually wrong since it change the behaviour of the results on the basis of user permissions.
As best practices, the response to a request should contain either the expected result of an error stating the missing permissions.

i.e.
on a request for a client that has read permissions only on user name like
```graphql
query user {
name
email
}
```

current result doesn't let the client that it did not have access to email
```graphql
data: {
user: {
name
}
}
```

expected result will look something like this
```graphql
data: {
user: {
name
}
},
errors: [
{
"message": "Unauthorized to access user.email "
// ...additional fields...
}
]
```

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.