Applying Our Server-Side Authorization Checks

Hi emilien! I think I'm following correctly, but let me know if this sounds off base.

So, we manage this with our organizations by querying the active org through the authenticated user, which ensures the user is a member of the org. If the user sets an id of an org that they aren't a member of, our query won't find a match and will instead overwrite the user's active org to the first org found that they're a member of.

For our application, the active organization is determined via a cookie. It sounds like you might have this set up as a route parameter.

If that's the case, ensure you attempt to query the workspace through the authenticated user. If a workspace is not found, you'll want to either:

1. Throw an unauthorized exception to prevent the user from working with the workspace. You can then offer some button to take them back to safety.

2. Or, find a valid workspace for the user and redirect them to it. You'll also want to notify them that they did not have access to the previously requested workspace.

The first option there probably being the best as it will ensure the user knows what happened. You don't want to continue onward as the URL contains an invalid id for the user, which could accidentally be used to load something or on subsequent requests sent from whatever page is rendered as a result.

Hopefully that's at least a little on point and helps a little. If not, please feel free to share your query/flow, or a representation of it, and I can try and see if anything stands out.

Hi memsbdm!

Unless you're looking to handle these exceptions a specific way, the built in status page functionality of AdonisJS should suffice for these! These status pages work the same way in Inertia as they do in standard AdonisJS.

Any status codes within the range specified via the statusPages object, which is located within your app/exceptions/handle.ts file, will render out the designated page for that status code to alert your user of the exception.

import app from '@adonisjs/core/services/app'
import { HttpContext, ExceptionHandler } from '@adonisjs/core/http'
import type { StatusPageRange, StatusPageRenderer } from '@adonisjs/core/types/http'

export default class HttpExceptionHandler extends ExceptionHandler {
  // ...

  /**
   * Status pages are used to display a custom HTML pages for certain error
   * codes. You might want to enable them in production only, but feel
   * free to enable them in development as well.
   */
  protected renderStatusPages = app.inProduction

  /**
   * Status pages is a collection of error code range and a callback
   * to return the HTML contents to send as a response.
   */
  protected statusPages: Record<StatusPageRange, StatusPageRenderer> = {
    '404': (error, { inertia }) => inertia.render('errors/not_found', { error }),
    '500..599': (error, { inertia }) => inertia.render('errors/server_error', { error }),
  }

  // ...
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

If, as shown in your example, you're looking to redirect the user back to the previous page when the exception is raised and alert them via a toast (or something similar) instead. You could create an exception with a handle method doing exactly that, then extend that exception for your ConflictException and any others you've created.

I believe that'd look something like the below!

// app/exceptions/exception_redirect_handler
export default class ExceptionRedirectHandler extends Exception {
  async handle(error: unknown, ctx: HttpContext) {
    ctx.session.flashErrors({ [error.code!]: error.message }) // to access it using errors.E_CONFLICT
    return ctx.response.redirect().back()
  }
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  

export default class ConflictException extends ExceptionRedirectHandler {
  static status = 409
  static code = 'E_CONFLICT'
}

  

    

      Copied!
      

        

      
    
  
  
    
    
    
    
  
app
exceptions
conflect_exception.ts