angeloashmore / doorbell_api Goto Github PK

# /web/abilities.ex

@doc """
Allows an owner or admin to update or delete any TeamMember.
"""
def can?(%User{} = user, action, %TeamMember{team_id: team_id})
  when action in [:update, :delete],
  do: has_roles_for_team?(user, %Team{id: team_id}, ["owner", "admin"])

Need to change the permissions on TeamMember to ensure:

• Admins cannot delete owners
• Admins cannot update an existing or create a new TeamMember as an owner

A user is created in the DB only when a user create an account with Auth0.

Auth0 has a hook on user creation to send a POST request to /users with a custom JWT to ensure it is Auth0.

Currently, only authorized users can create a new user (which makes no sense… no one could sign up!).