api.pawol.nu/src/policies/is-document-owner.js

'use strict';

const { UnauthorizedError, NotFoundError } = require('@strapi/utils').errors;

module.exports = async (policyContext, config, {strapi}) => {
  const {request, params} = policyContext;

  if (!request?.header?.authorization) {
    throw new UnauthorizedError('Opération non autorisée');
  }

  let jwtUserId;
  try {
    ({id: jwtUserId} = await strapi.plugins['users-permissions'].services.jwt.getToken(policyContext));
  } catch (err) {
    throw new UnauthorizedError('Opération non autorisée');
  }

  const documentId = params?.id ?? request.body?.data?.documentId;

  const document = await strapi.db.query(config.uid).findOne({
    where: {documentId},
    populate: {user: true}
  });

  if (!document) {
    throw new NotFoundError('Ressource introuvable.');
  }

  if (document.user?.id !== jwtUserId) {
    throw new UnauthorizedError('Opération non autorisée');
  }

  return true;
};