api.pawol.nu/src/policies/is-payload-owner.js

'use strict';

const { UnauthorizedError } = require('@strapi/utils').errors;

module.exports = async (policyContext, config, {strapi}) => {
  const {request} = policyContext;

  if (!request?.header?.authorization) {
    throw new UnauthorizedError('Opération non autorisée');
  }

  try {
    const {id} = await strapi.plugins['users-permissions'].services.jwt.getToken(policyContext);

    if (id !== request.body?.data?.user?.id) {
      throw new UnauthorizedError('Opération non autorisée');
    }
  } catch (err) {
    throw new UnauthorizedError('Opération non autorisée');
  }

  return true;
};