ConditionallyUpdatable
in package
Column that a caller without the `updateColumns` privilege may still write via `updateColumns`, but only when a named Api presenter method approves it.
Conditional sibling of PubliclyUpdatable. The name is explicit rather than a
convention, because a typo in a convention fails closed with a misleading "no permission";
a test checks that every named method exists. Signature:
(int $id, mixed $value, ?int $userId): bool, called once per record; a single false
fails the whole bulk call. $userId comes from getJwtPayload(), null is anonymous.
IMPORTANT: the method must decide against the DB, not the payload, and return false when
unsure. Otherwise a crafted payload could write the column.
Usage:
#[ConditionallyUpdatable(check: 'checkPermissionForRead')]
protected bool $read = false;
Tags
Attributes
- #[Attribute]
- \Attribute::TARGET_PROPERTY
Table of Contents
Properties
- $check : string
Methods
- __construct() : mixed
Properties
$check read-only
public
string
$check
Methods
__construct()
public
__construct(string $check) : mixed
Parameters
- $check : string
-
name of the Api presenter method that decides the write; it may be
protectedbecauseSaveTraitcalls it on the presenter itself