fix(security): enforce API authentication rules on collection (#214)

- Add authentication and authorization rules to prevent unauthorized access via REST API endpoints.
2026-02-27 00:17:45 +07:00
parent 9dbd267a22
commit f2c338ced9
25 changed files with 793 additions and 355 deletions
@@ -0,0 +1,28 @@
+/// <reference path="../pb_data/types.d.ts" />
+migrate((app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "@request.auth.id != \"\"",
+    "deleteRule": "@request.auth.id != \"\"",
+    "listRule": "@request.auth.id != \"\"",
+    "updateRule": "@request.auth.id != \"\"",
+    "viewRule": "@request.auth.id != \"\""
+  }, collection)
+
+  return app.save(collection)
+}, (app) => {
+  const collection = app.findCollectionByNameOrId("pbc_2889059272")
+
+  // update collection data
+  unmarshal({
+    "createRule": "",
+    "deleteRule": "",
+    "listRule": "",
+    "updateRule": "",
+    "viewRule": ""
+  }, collection)
+
+  return app.save(collection)
+})