claude
6c17e42037
assembleDebug, testDebugUnitTest, and recordPaparazziDebug all pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016bThmkmyUUdqQpy3MXFFe5
22 lines
1.0 KiB
JavaScript
22 lines
1.0 KiB
JavaScript
/// <reference path="../pb_data/types.d.ts" />
|
|
|
|
// PocketBase's declarative API rules act as row-level filters for the
|
|
// "list"/"search" action: an unsatisfiable listRule (e.g. requiring auth)
|
|
// still returns 200 with an empty result set rather than an error, because
|
|
// the rule is just a SQL WHERE clause under the hood. See
|
|
// https://github.com/pocketbase/pocketbase/discussions/6492
|
|
//
|
|
// Bookshelf is a private, two-person library — no anonymous caller should
|
|
// ever get a 200 back from these endpoints, even an empty one, since some
|
|
// HTTP/JS clients treat "200 with []" as a successful, allowed request.
|
|
// This hook makes that explicit: anonymous list/search requests against the
|
|
// three app collections are rejected with 403, matching create/update/
|
|
// view/delete (which already 400/404 for unauthenticated callers via the
|
|
// declarative rules alone).
|
|
onRecordsListRequest((e) => {
|
|
if (!e.auth) {
|
|
throw new ForbiddenError("Authentication required.");
|
|
}
|
|
e.next();
|
|
}, "bookcases", "shelves", "books");
|