Permissions for administrators and customers. Used to control access to GraphQL resolvers via the Allow decorator.
Permission.Owner is a special permission which is used in some Vendure resolvers to indicate that that resolver should only
be accessible to the "owner" of that resource.
For example, the Shop API activeCustomer query resolver should only return the Customer object for the "owner" of that Customer, i.e.
based on the activeUserId of the current session. As a result, the resolver code looks like this:
Example
Here we can see that the "ownership" must be enforced by custom logic inside the resolver. Since "ownership" cannot be defined generally
nor statically encoded at build-time, any resolvers using Permission.Owner must include logic to enforce that only the owner
of the resource has access. If not, then it is the equivalent of using Permission.Public.
Architecture reviews, custom plugin work, migrations, ongoing support. Get a hand from the team that builds Vendure.
Talk to the team