Function setupOpMiddleware

test/middleware.js:242–264

(backend)

  describe('access control', function() {
    function setupOpMiddleware(backend) {
      backend.use('apply', function(request, next) {
        request.priorAccountId = request.snapshot.data && request.snapshot.data.accountId;
        next();
      });
      backend.use('commit', function(request, next) {
        var accountId = (request.snapshot.data) ?
          // For created documents, get the accountId from the document data
          request.snapshot.data.accountId :
          // For deleted documents, get the accountId from before
          request.priorAccountId;
        // Store the accountId for the document on the op for efficient access control
        request.op.accountId = accountId;
        next();
      });
      backend.use('op', function(request, next) {
        if (request.op.accountId === request.agent.accountId) {
          return next();
        }
        var err = {message: 'op accountId does not match', code: 'ERR_OP_READ_FORBIDDEN'};
        return next(err);
      });
    }

    it('is possible to cache add additional top-level fields on ops for access control', function(done) {
      setupOpMiddleware(this.backend);