refactor: extraire la vérification JWT/payload en policy partagée

src/policies/is-payload-owner.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const { UnauthorizedError } = require('@strapi/utils').errors
+
+module.exports = async (policyContext, config, {strapi}) => {
+  const {request} = policyContext
+
+  if (!request?.header?.authorization) {
+    return true
+  }
+
+  try {
+    const {id} = await strapi.plugins['users-permissions'].services.jwt.getToken(policyContext)
+
+    if (id !== request.body?.data?.user?.id) {
+      throw new UnauthorizedError('Opération non autorisée')
+    }
+  } catch (err) {
+    throw new UnauthorizedError('Opération non autorisée')
+  }
+
+  return true
+}