From 2f43a3566dee06ca982bcf1bf4f822ef2179c06c Mon Sep 17 00:00:00 2001 From: Jake Barnby Date: Wed, 5 Mar 2025 16:42:09 +1300 Subject: [PATCH] Remove bulk update permissions param --- app/config/specs/open-api3-1.6.x-client.json | 10 +--------- app/config/specs/open-api3-1.6.x-console.json | 10 +--------- app/config/specs/open-api3-1.6.x-server.json | 10 +--------- app/config/specs/open-api3-latest-client.json | 10 +--------- app/config/specs/open-api3-latest-console.json | 10 +--------- app/config/specs/open-api3-latest-server.json | 10 +--------- app/config/specs/swagger2-1.6.x-client.json | 11 +---------- app/config/specs/swagger2-1.6.x-console.json | 11 +---------- app/config/specs/swagger2-1.6.x-server.json | 11 +---------- app/config/specs/swagger2-latest-client.json | 11 +---------- app/config/specs/swagger2-latest-console.json | 11 +---------- app/config/specs/swagger2-latest-server.json | 11 +---------- app/controllers/api/databases.php | 15 +++++++++------ 13 files changed, 21 insertions(+), 120 deletions(-) diff --git a/app/config/specs/open-api3-1.6.x-client.json b/app/config/specs/open-api3-1.6.x-client.json index d5351f7f58..0b92434498 100644 --- a/app/config/specs/open-api3-1.6.x-client.json +++ b/app/config/specs/open-api3-1.6.x-client.json @@ -4520,7 +4520,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -4595,14 +4595,6 @@ "description": "Document data as JSON object. Include only attribute and value pairs to be updated.", "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/open-api3-1.6.x-console.json b/app/config/specs/open-api3-1.6.x-console.json index 3feb176ab7..845ebef2ef 100644 --- a/app/config/specs/open-api3-1.6.x-console.json +++ b/app/config/specs/open-api3-1.6.x-console.json @@ -7978,7 +7978,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -8053,14 +8053,6 @@ "description": "Document data as JSON object. Include only attribute and value pairs to be updated.", "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/open-api3-1.6.x-server.json b/app/config/specs/open-api3-1.6.x-server.json index 22dcd0dd14..120be407a2 100644 --- a/app/config/specs/open-api3-1.6.x-server.json +++ b/app/config/specs/open-api3-1.6.x-server.json @@ -7538,7 +7538,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -7615,14 +7615,6 @@ "description": "Document data as JSON object. Include only attribute and value pairs to be updated.", "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/open-api3-latest-client.json b/app/config/specs/open-api3-latest-client.json index d5351f7f58..0b92434498 100644 --- a/app/config/specs/open-api3-latest-client.json +++ b/app/config/specs/open-api3-latest-client.json @@ -4520,7 +4520,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -4595,14 +4595,6 @@ "description": "Document data as JSON object. Include only attribute and value pairs to be updated.", "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/open-api3-latest-console.json b/app/config/specs/open-api3-latest-console.json index 3feb176ab7..845ebef2ef 100644 --- a/app/config/specs/open-api3-latest-console.json +++ b/app/config/specs/open-api3-latest-console.json @@ -7978,7 +7978,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -8053,14 +8053,6 @@ "description": "Document data as JSON object. Include only attribute and value pairs to be updated.", "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/open-api3-latest-server.json b/app/config/specs/open-api3-latest-server.json index 22dcd0dd14..120be407a2 100644 --- a/app/config/specs/open-api3-latest-server.json +++ b/app/config/specs/open-api3-latest-server.json @@ -7538,7 +7538,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -7615,14 +7615,6 @@ "description": "Document data as JSON object. Include only attribute and value pairs to be updated.", "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/swagger2-1.6.x-client.json b/app/config/specs/swagger2-1.6.x-client.json index d8a3baa218..2f9375f3b9 100644 --- a/app/config/specs/swagger2-1.6.x-client.json +++ b/app/config/specs/swagger2-1.6.x-client.json @@ -4702,7 +4702,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -4769,15 +4769,6 @@ "default": [], "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "default": null, - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/swagger2-1.6.x-console.json b/app/config/specs/swagger2-1.6.x-console.json index a05af4546c..fef7ff4ea5 100644 --- a/app/config/specs/swagger2-1.6.x-console.json +++ b/app/config/specs/swagger2-1.6.x-console.json @@ -8167,7 +8167,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -8234,15 +8234,6 @@ "default": [], "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "default": null, - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/swagger2-1.6.x-server.json b/app/config/specs/swagger2-1.6.x-server.json index a76c25257d..3aaf42f08c 100644 --- a/app/config/specs/swagger2-1.6.x-server.json +++ b/app/config/specs/swagger2-1.6.x-server.json @@ -7709,7 +7709,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -7778,15 +7778,6 @@ "default": [], "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "default": null, - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/swagger2-latest-client.json b/app/config/specs/swagger2-latest-client.json index d8a3baa218..2f9375f3b9 100644 --- a/app/config/specs/swagger2-latest-client.json +++ b/app/config/specs/swagger2-latest-client.json @@ -4702,7 +4702,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -4769,15 +4769,6 @@ "default": [], "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "default": null, - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/swagger2-latest-console.json b/app/config/specs/swagger2-latest-console.json index a05af4546c..fef7ff4ea5 100644 --- a/app/config/specs/swagger2-latest-console.json +++ b/app/config/specs/swagger2-latest-console.json @@ -8167,7 +8167,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -8234,15 +8234,6 @@ "default": [], "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "default": null, - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/config/specs/swagger2-latest-server.json b/app/config/specs/swagger2-latest-server.json index a76c25257d..3aaf42f08c 100644 --- a/app/config/specs/swagger2-latest-server.json +++ b/app/config/specs/swagger2-latest-server.json @@ -7709,7 +7709,7 @@ "tags": [ "databases" ], - "description": "Update all documents that match your queries, If none are submitted then all documents are updated. Using the patch method you can pass only specific fields that will get updated.", + "description": "Update all documents that match your queries, if no queries are submitted then all documents are updated. You can pass only specific fields to be updated.", "responses": { "200": { "description": "Documents List", @@ -7778,15 +7778,6 @@ "default": [], "x-example": "{}" }, - "permissions": { - "type": "array", - "description": "An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https:\/\/appwrite.io\/docs\/permissions).", - "default": null, - "x-example": "[\"read(\"any\")\"]", - "items": { - "type": "string" - } - }, "queries": { "type": "array", "description": "Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https:\/\/appwrite.io\/docs\/queries). Maximum of 100 queries are allowed, each 4096 characters long.", diff --git a/app/controllers/api/databases.php b/app/controllers/api/databases.php index f76322924f..4617e6135e 100644 --- a/app/controllers/api/databases.php +++ b/app/controllers/api/databases.php @@ -4136,24 +4136,25 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents') ->param('databaseId', '', new UID(), 'Database ID.') ->param('collectionId', '', new UID(), 'Collection ID.') ->param('data', [], new JSON(), 'Document data as JSON object. Include only attribute and value pairs to be updated.', true) - ->param('permissions', null, new Permissions(APP_LIMIT_ARRAY_PARAMS_SIZE, [Database::PERMISSION_READ, Database::PERMISSION_UPDATE, Database::PERMISSION_DELETE, Database::PERMISSION_WRITE]), 'An array of permissions strings. By default, the current permissions are inherited. [Learn more about permissions](https://appwrite.io/docs/permissions).', true) ->param('queries', [], new ArrayList(new Text(APP_LIMIT_ARRAY_ELEMENT_SIZE), APP_LIMIT_ARRAY_PARAMS_SIZE), 'Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/queries). Maximum of ' . APP_LIMIT_ARRAY_PARAMS_SIZE . ' queries are allowed, each ' . APP_LIMIT_ARRAY_ELEMENT_SIZE . ' characters long.', true) ->inject('requestTimestamp') ->inject('response') ->inject('dbForProject') ->inject('project') - ->action(function (string $databaseId, string $collectionId, string|array $data, ?array $permissions, array $queries, ?\DateTime $requestTimestamp, Response $response, Database $dbForProject, Document $project) { - $data = (\is_string($data)) ? \json_decode($data, true) : $data; // Cast to JSON array + ->action(function (string $databaseId, string $collectionId, string|array $data, array $queries, ?\DateTime $requestTimestamp, Response $response, Database $dbForProject, Document $project) { + $data = \is_string($data) + ? \json_decode($data, true) + : $data; - if (empty($data) && \is_null($permissions)) { + if (empty($data)) { throw new Exception(Exception::DOCUMENT_MISSING_PAYLOAD); } - $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId)); - $isAPIKey = Auth::isAppUser(Authorization::getRoles()); $isPrivilegedUser = Auth::isPrivilegedUser(Authorization::getRoles()); + $database = Authorization::skip(fn () => $dbForProject->getDocument('databases', $databaseId)); + if ($database->isEmpty() || (!$database->getAttribute('enabled', false) && !$isAPIKey && !$isPrivilegedUser)) { throw new Exception(Exception::DATABASE_NOT_FOUND); } @@ -4170,6 +4171,8 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents') throw new Exception(Exception::GENERAL_QUERY_INVALID, $e->getMessage()); } + $permissions = $data['$permissions'] ?? null; + // Map aggregate permissions into the multiple permissions they represent. $permissions = Permission::aggregate($permissions, [ Database::PERMISSION_READ,