lib/secureAccessMethods.js
function updateSecure(user, options) {
    // jscs:disable
    // jshint -W040
    const self = this;
    // jshint +W040
    // jscs:enable
    const Model = self.constructor;
    const shield = Model.shield;
    const action = 'update';
    const rules = shield.getApplicableRules(action);
    const primaryKey = Model.idAttribute;
    const query = {};
    const tmpModel = Model.forge(query);

    // validate that the model isNew
    if (self.isNew()) {
        return Promise.reject(
            new AuthError('attempt to update a new record')
        );
    }

    query[primaryKey] = self.get(primaryKey);
    return tmpModel.read(user)
        .then(function validateUpdatePrivs(originalModel) {
            // TODO: investigate what happens if fetch returns nothing (err?)
            return applyRules(rules, originalModel, user);
        }).then(function executeUpdate() {
            return shield._save.call(self, options);
        });
}
function updateSecure(user, options) {
    // jscs:disable
    // jshint -W040
    const self = this;
    // jshint +W040
    // jscs:enable
    const Model = self.constructor;
    const shield = Model.shield;
    const action = 'update';
    const rules = shield.getApplicableRules(action);
    const primaryKey = Model.idAttribute;
    const query = {};
    const tmpModel = Model.forge(query);

    // validate that the model isNew
    if (self.isNew()) {
        return Promise.reject(
            new AuthError('attempt to update a new record')
        );
    }

    query[primaryKey] = self.get(primaryKey);
    return tmpModel.read(user)
        .then(function validateUpdatePrivs(originalModel) {
            // TODO: investigate what happens if fetch returns nothing (err?)
            return applyRules(rules, originalModel, user);
        }).then(function executeUpdate() {
            return shield._save.call(self, options);
        });
}
function updateSecure ( user , options ) { // jscs:disable // jshint -W040 const self = this ; // jshint +W040 // jscs:enable const Model = self . constructor ; const shield = Model . shield ; const action = 'update' ; const rules = shield . getApplicableRules ( action ) ; const primaryKey = Model . idAttribute ; const query = { } ; const tmpModel = Model . forge ( query ) ; // validate that the model isNew if ( self . isNew ( ) ) { return Promise . reject ( new AuthError ( 'attempt to update a new record' ) ) ; } query [ primaryKey ] = self . get ( primaryKey ) ; return tmpModel . read ( user ) . then ( function validateUpdatePrivs ( originalModel ) { // TODO: investigate what happens if fetch returns nothing (err?) return applyRules ( rules , originalModel , user ) ; } ) . then ( function executeUpdate ( ) { return shield . _save . call ( self , options ) ; } ) ; }
update an existing record in DB after verifying privs
Permissions are validated against the current record in DB
@param {object} user is the user credentials
@param {object} options are options to be passed to save call
@return {Promise} resolves to save result or rejects with auth error
update an existing record in DB after verifying privs Permissions are validated against the current record in DB