Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Catch AuthorzationExceptions from database to throw 401 instead of 500

Browse Source
This commit is contained in:
Jake Barnby
2022-08-25 23:30:26 +12:00
parent a373297a6b
commit e6e126dff4
2 changed files with 58 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/controllers/api/databases.php
+12 -3
View File
@@ -2067,7 +2067,11 @@ App::get('/v1/databases/:databaseId/collections/:collectionId/documents/:documen
}
if ($documentSecurity && !$valid) {
$document = $dbForProject->getDocument('database_' . $database->getInternalId() . '_collection_' . $collection->getInternalId(), $documentId);
try {
$document = $dbForProject->getDocument('database_' . $database->getInternalId() . '_collection_' . $collection->getInternalId(), $documentId);
} catch (AuthorizationException) {
throw new Exception(Exception::USER_UNAUTHORIZED);
}
} else {
$document = Authorization::skip(fn () => $dbForProject->getDocument('database_' . $database->getInternalId() . '_collection_' . $collection->getInternalId(), $documentId));
}
@@ -2081,7 +2085,6 @@ App::get('/v1/databases/:databaseId/collections/:collectionId/documents/:documen
*/
$document->setAttribute('$collection', $collectionId);
$response->dynamic($document, Response::MODEL_DOCUMENT);
});
@@ -2292,6 +2295,8 @@ App::patch('/v1/databases/:databaseId/collections/:collectionId/documents/:docum
* Reset $collection attribute to remove prefix.
*/
$document->setAttribute('$collection', $collectionId);
} catch (AuthorizationException) {
throw new Exception(Exception::USER_UNAUTHORIZED);
} catch (DuplicateException) {
throw new Exception(Exception::DOCUMENT_ALREADY_EXISTS);
} catch (StructureException $exception) {
@@ -2363,7 +2368,11 @@ App::delete('/v1/databases/:databaseId/collections/:collectionId/documents/:docu
}
if ($documentSecurity && !$valid) {
$dbForProject->deleteDocument('database_' . $database->getInternalId() . '_collection_' . $collection->getInternalId(), $documentId);
try {
$dbForProject->deleteDocument('database_' . $database->getInternalId() . '_collection_' . $collection->getInternalId(), $documentId);
} catch (AuthorizationException) {
throw new Exception(Exception::USER_UNAUTHORIZED);
}
} else {
Authorization::skip(fn() => $dbForProject->deleteDocument('database_' . $database->getInternalId() . '_collection_' . $collection->getInternalId(), $documentId));
}