Marcus mphasize

An example on how to setup Many-to-Many relationships through a junction table with it's own model definition, enabling individual attributes and filtering on the relationship.

I am keeping this as a reference to balderdashy/sails#352

Working with SailsJS v0.10-rc5: I am trying to keep the magic of blueprint controllers while at the same time protecting some model attributes from being changed by users on the default routes. I.e.: prevent access to the is_admin attribute on regular CRUD routes and implement a promote action or something similar on the UserController which makes the neccessary checks.

In order to do this, I came up with the following policy in combination with a small addition to the model definitions:

// file: api/policies/protectedAttributes.js

/**

	import type { ComponentType } from "react"
	import { useState, useEffect } from "react"
	import { Override } from "framer"
	import { Manager } from "https://jspm.dev/socket.io-client"

	// Learn more: https://www.framer.com/docs/guides/code-components/
	// Use with https://blokdots.com and the Socket.IO server integration

	let manager = null
	let socket = null

	/**
	* beforeBlueprint
	*
	* @module :: Policy
	* @description :: Simple policy to enable hooks into the model which can act upon req, res objects.
	* @docs :: http://sailsjs.org/#!documentation/policies
	*
	*/

	var actionUtil = require( 'sails/lib/hooks/blueprints/actionUtil' );

	/**
	* beforeCreate
	*
	* @module :: Policy
	* @description :: Simple policy to inject the user creating a record into the records values.
	* Assumes req.user && req.user.id to be set when a user is logged in.
	* @docs :: http://sailsjs.org/#!documentation/policies
	*
	*/

	// https://github.com/balderdashy/sails/blob/master/lib/hooks/blueprints/actionUtil.js

	/**
	* AccessControl proxy function, expects a Waterline query object for before* hooks and an array of records for after* hooks.
	* @param {Collection} model Waterline collectio, from parseModel
	* @param {String} action blueprint or hook, e.g. beforeFind, afterFind, beforeCreate, afterCreate --> translates to accessControlBeforeFind, etc.
	* @param {Object} options Options: query {Query} Waterline query object for before* hooks, records: {Array} records for after* hooks, {Model} current user record
	* @return {Query\|Array} returns the modified query (with altered criteria) for before* or the filtered/extended record array for after*.
	*/
	accessControl: function ( model, action, options, callback ) {