ORGANISATION-KA-INTERNATIONALE/api.pawol.nu
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: refuser par défaut is-payload-owner sans en-tête Authorization

Browse Source
This commit is contained in:
cedric
2026-07-04 11:35:41 +04:00
parent e515944fb9
commit bc5d0fb498
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/policies/__tests__/is-payload-owner.test.js
+2 -2
View File
@@ -26,11 +26,11 @@ function buildPolicyContext({authorization, payloadUserId}) {
} }
describe('is-payload-owner policy', () => { describe('is-payload-owner policy', () => {
it("autorise quand aucun en-tête d'autorisation n'est présent", async () => { it("refuse quand aucun en-tête d'autorisation n'est présent", async () => {
const strapi = buildStrapi(999) const strapi = buildStrapi(999)
const policyContext = buildPolicyContext({authorization: undefined, payloadUserId: 1}) const policyContext = buildPolicyContext({authorization: undefined, payloadUserId: 1})
await expect(isPayloadOwner(policyContext, {}, {strapi})).resolves.toBe(true) await expect(isPayloadOwner(policyContext, {}, {strapi})).rejects.toThrow('Opération non autorisée')
}) })
it('autorise quand le user du JWT correspond au user du payload', async () => { it('autorise quand le user du JWT correspond au user du payload', async () => {
src/policies/is-payload-owner.js
+1 -1
View File
@@ -6,7 +6,7 @@ module.exports = async (policyContext, config, {strapi}) => {
const {request} = policyContext const {request} = policyContext
if (!request?.header?.authorization) { if (!request?.header?.authorization) {
return true throw new UnauthorizedError('Opération non autorisée')
} }
try { try {