https://www.prisma.io/ logo
Join Slack
Powered by
Why is it when I see examples of using `update` wi...
# orm-help
a
Why is it when I see examples of using 
update
with prisma
Copy code
prisma.post.update({
  where: { id: postId },
  data: { ...data }
})
How come they never check that the resource belongs to the person making the call to update? Even if the route is protected wouldn't that allow anyone who is authenticated to update resources that don't belong to them?
Would you have to find the resource first.
Copy code
const post = prisma.post.findUnique({
  where: { id: postId }
})

if (post.authorId !== userId) throw Error() // userId being currently logged in user

prisma.post.update({
  where: { id: postId },
  data: { ...data }
})
Wouldn't this be the correct way to do it?
m
How you handle that is up to you. That check is fine for your use case. Are you using graphql by any chance? Remember that this is another db query. Sometimes you can just store a jwt in http oonly cookie with userId and check against that. Best if that jwt is being refreshed regularly.
a
I'm not using graphql. I have the user datat stored in a jwt already. I'm just wondering on the backend, I need to check if the post belongs to the user making the request right?
I was testing this with postman, I logged in as a user and I was able to update a post without being the owner of it
m
Yes in that case, that's how you would do it. Your example is correct. You could probably make this in one query for updateMany. 
.update
will probably allow you only one 
unique
argument. Can you check?
Copy code
prisma.post.updateMany({
  where: { id: postId, authorId: userId },
  data: { ...data }
})
But usually that check of yours is the correct way, yes.
r
This sort of thing sort of falls out of scope of an orm, how you handle that logic is up to you
a
@Maciek K oh yeah that seems to work. It just returns a count of how many resources were updated
it only accepts the 
where
and 
data
field so I don't think I can return the data I need from using 
updateMany
I'll just stick to what I had before
@Robert Fish that's true, I was just trying to figure out what the best practice was
Open in Slack
PreviousNext
Powered by