permission定义有些奇怪
在很多文件中对permission的配置都有些奇怪。例如: uni-id-scores.schema.json文件中
"permission": {
"read": true,
"create": true,
"update": "doc._id == auth.uid",
"delete": false
},
这里关于update的定义,应该意图应该是只允许用户自己更新自己的数据,但doc._id却是uni-id-scores表单的_id号。这里明显达不到这个目的?
又例如: uni-id-users.schema.json文件中
"permission":{
"update":"doc.uid==auth.uid"
},
"required": [],
"properties": {
"_id": {
"description": "存储文档 ID(用户 ID),系统自动生成"
},
"username": {
"bsonType": "string",
"title": "用户名",
"description": "用户名,不允许重复",
"trim": "both"
},
"password": {
"bsonType": "password",
"title": "密码",
"description": "密码,加密存储",
在properties中根本没有uid字段的存在,doc.uid又有何意义?
又例如: opendb-news-favorite.schema.json文件中
"permission": {
"read": "doc.uid == auth.uid",
"create": "auth.uid != null",
"update": "doc.uid == auth.uid",
"delete": "doc.uid == auth.uid"
},
"properties": {
"_id": {
"description": "ID,系统自动生成"
},
"article_id": {
"bsonType": "string",
"description": "文章id,参考opendb-news-articles表",
"foreignKey": "opendb-news-articles._id"
},
"article_title": {
"bsonType": "string",
"description": "文章标题"
},
"user_id": {
"bsonType": "string",
"description": "收藏者id,参考uni-id-users表",
"forceDefaultValue": {
"$env": "uid"
},
"foreignKey": "uni-id-users._id"
},
"create_date": {
在properties中只定义了user_id,按我的理解
"permission": {
"read": "doc.uid == auth.uid",
"create": "auth.uid != null",
"update": "doc.uid == auth.uid",
"delete": "doc.uid == auth.uid"
},
不应该写成这样吗?
"permission": {
"read": "doc.user_id == auth.uid",
"create": "auth.uid != null",
"update": "doc.user_id == auth.uid",
"delete": "doc.user_id == auth.uid"
},
或许我对文档理解有错误吧,我的理解是doc后面不都应该跟着properties定义过的字段吗?而这些源码都违背了此原则。