@@ -39,6 +39,8 @@ model Space {
39
39
id String @id @default(uuid())
40
40
createdAt DateTime @default(now())
41
41
updatedAt DateTime @updatedAt
42
+ owner User @relation(fields: [ownerId], references: [id], onDelete: Cascade)
43
+ ownerId String @default(auth().id)
42
44
name String @length(4, 50)
43
45
slug String @unique @regex('^[0-9a-zA-Z]{4,16}$')
44
46
members SpaceUser[]
@@ -74,8 +76,11 @@ model SpaceUser {
74
76
// require login
75
77
@@deny('all', auth() == null)
76
78
77
- // space admin can create/update/delete
78
- @@allow('create,update,delete', space.members?[user == auth() && role == ADMIN])
79
+ // space owner can add any one
80
+ @@allow('create', space.owner == auth())
81
+
82
+ // space admin can add anyone but not himself
83
+ @@allow('create', auth() != this.user && space.members?[user == auth() && role == ADMIN])
79
84
80
85
// user can read entries for spaces which he's a member of
81
86
@@allow('read', space.members?[user == auth()])
@@ -92,7 +97,8 @@ model User {
92
97
emailVerified DateTime?
93
98
password String? @password @omit
94
99
name String?
95
- spaces SpaceUser[]
100
+ ownedSpaces Space[]
101
+ memberships SpaceUser[]
96
102
image String? @url
97
103
lists List[]
98
104
todos Todo[]
@@ -104,7 +110,7 @@ model User {
104
110
@@allow('create', true)
105
111
106
112
// can be read by users sharing any space
107
- @@allow('read', spaces ?[space.members?[user == auth()]])
113
+ @@allow('read', memberships ?[space.members?[user == auth()]])
108
114
109
115
// full access by oneself
110
116
@@allow('all', auth() == this)
0 commit comments