24 lines
558 B
JavaScript
24 lines
558 B
JavaScript
|
'use strict';
|
||
|
|
|
||
|
|
const { UnauthorizedError } = require('@strapi/utils').errors
|
||
|
|
|
||
|
|
module.exports = async (policyContext, config, {strapi}) => {
|
||
|
|
const {request} = policyContext
|
||
|
|
|
||
|
|
if (!request?.header?.authorization) {
|
||
|
|
return true
|
||
|
|
}
|
||
|
|
|
||
|
|
try {
|
||
|
|
const {id} = await strapi.plugins['users-permissions'].services.jwt.getToken(policyContext)
|
||
|
|
|
||
|
|
if (id !== request.body?.data?.user?.id) {
|
||
|
|
throw new UnauthorizedError('Opération non autorisée')
|
||
|
|
}
|
||
|
|
} catch (err) {
|
||
|
|
throw new UnauthorizedError('Opération non autorisée')
|
||
|
|
}
|
||
|
|
|
||
|
|
return true
|
||
|
|
}
|