{"action":"opened","issue":{"url":"https://api.github.com/repos/tjwebb/sails-permissions/issues/190","labels_url":"https://api.github.com/repos/tjwebb/sails-permissions/issues/190/labels{/name}","comments_url":"https://api.github.com/repos/tjwebb/sails-permissions/issues/190/comments","events_url":"https://api.github.com/repos/tjwebb/sails-permissions/issues/190/events","html_url":"https://github.com/tjwebb/sails-permissions/issues/190","id":118035462,"number":190,"title":"Best Way to Prevent Unwanted Updates on Current User","user":{"login":"GeekLad","id":143769,"avatar_url":"https://avatars.githubusercontent.com/u/143769?v=3","gravatar_id":"","url":"https://api.github.com/users/GeekLad","html_url":"https://github.com/GeekLad","followers_url":"https://api.github.com/users/GeekLad/followers","following_url":"https://api.github.com/users/GeekLad/following{/other_user}","gists_url":"https://api.github.com/users/GeekLad/gists{/gist_id}","starred_url":"https://api.github.com/users/GeekLad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GeekLad/subscriptions","organizations_url":"https://api.github.com/users/GeekLad/orgs","repos_url":"https://api.github.com/users/GeekLad/repos","events_url":"https://api.github.com/users/GeekLad/events{/privacy}","received_events_url":"https://api.github.com/users/GeekLad/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-20T12:51:04Z","updated_at":"2015-11-20T12:51:04Z","closed_at":null,"body":"I'm working on building CRUD interfaces to manage ```User```, ```Role```, and ```Permission``` and I want to put in some server-side safeguards to prevent a logged-in admin user from performing some unwanted updates on its own account:\r\n\r\n* Delete itself\r\n* Remove the admin role from itself\r\n* Removing CRUD operations from itself for Permissions to prevent the admin from removing a permission it won't ever be able to get back\r\n\r\nPrevention of a delete operation on the current user wasn't too difficult.  I created a policy called ```isNotSelf``` and put it on the ```delete``` action for the ```UserController```.  It compares the ```id``` of the current user to the ```id``` of the user for the ```delete``` operation, and if they're the same it results in a ```res.badRequest()```.\r\n\r\nTo easily modify role assignments I:\r\n\r\n* added a ```roles``` collection to the ```User``` model\r\n* use the REST API by passing an array of ```[role.id]``` to ```PUT /user/id```\r\n* if a role id is missing from the array that the user had previously, the role is removed\r\n* if a role id is in the array that the user did not have previously, the role is added\r\n\r\nTo prevent an admin user from removing the admin role from itself, it seems a ```beforeUpdate``` lifecycle callback in the ```User``` model seems would be in order.  However, I'm not sure how to get the ```id``` of the current logged-in admin user from there.  I think I probably also need to put a similar safeguard on the ```RoleController``` to prevent the removal of the currently logged in user via modifications to the ```Role``` model.\r\n\r\nThe same goes for disallowing CRUD operations on Permissions.  It seems like the best place to insert this safeguard would be in a ```beforeUpdate``` lifecycle callback, but I don't know how to get the currently logged-in user id.\r\n\r\nPlease help!"}}