Best Practices for API routes
Unanswered
Oriental chestnut gall wasp posted this in #help-forum
Oriental chestnut gall waspOP
This may be a dumb question and idk if there's a "right answer" or not but whatever.
I have an app where users can create events with their friends. When an event is created, a bunch of info is passed to the api route in the body, such as the title, location, date, etc. One of the necessary fields is the owner of the event. This will presumably be the person sending the request to the backend by hitting the "submit" button.
With this in mind, should the owner id be sent as part of the body of the request, or should I just get the id of the logged in user with Clerk and set it to that. I can think of pros and cons for each (the former makes sure that people can only make events for themselves but the latter could be useful for development/debugging?)
I don't have a ton of experience with backend or api routes in general so any advice is greatly appreciated. Thanks!
I have an app where users can create events with their friends. When an event is created, a bunch of info is passed to the api route in the body, such as the title, location, date, etc. One of the necessary fields is the owner of the event. This will presumably be the person sending the request to the backend by hitting the "submit" button.
With this in mind, should the owner id be sent as part of the body of the request, or should I just get the id of the logged in user with Clerk and set it to that. I can think of pros and cons for each (the former makes sure that people can only make events for themselves but the latter could be useful for development/debugging?)
I don't have a ton of experience with backend or api routes in general so any advice is greatly appreciated. Thanks!
15 Replies
Asian paper wasp
With this in mind, should the owner id be sent as part of the body of the request, or should I just get the id of the logged in user with Clerk and set it to that.
Here's what I would do. I would take the owner's ID from the request, but with role-based authorization in place.
What that means is that I will have a
getEventsByOwner(ownerId) method that can be called by anyone. However:1. Normal users can only pass his own ID as the ownerID, or else the API will return 403
2. Admins can pass any user IDs, for the sake of management, and auditing for example
Northeast Congo Lion
why isnt it working?
@Northeast Congo Lion why isnt it working?
Havana
Read the error and you'll figure out
@Northeast Congo Lion why isnt it working?
Asian paper wasp
The better question is, why do you think asking a completely unrelated question in here is a good idea.
@Asian paper wasp > With this in mind, should the owner id be sent as part of the body of the request, or should I just get the id of the logged in user with Clerk and set it to that.
Here's what I would do. I would take the owner's ID from the request, but with role-based authorization in place.
What that means is that I will have a `getEventsByOwner(ownerId)` method that can be called by anyone. However:
1. Normal users can only pass his own ID as the ownerID, or else the API will return 403
2. Admins can pass any user IDs, for the sake of management, and auditing for example
Oriental chestnut gall waspOP
Ok this is kinda what I was considering already. Thanks so much! I don't think Clerk has a built in "admin" or "superuser" feature to my knowledge, so I guess I'll have to include that in my own db
Asian paper wasp
The admin thing is just for a common practice when implementing our own backend.
If you are still using Clerk, you may not need it since your account is basically an admin already
If you are still using Clerk, you may not need it since your account is basically an admin already
Oriental chestnut gall waspOP
What do you mean by that?
I can visit the clerk dashboard, but does it have an effect in the app itself?
I am using clerk to store user data but I also have a "Person" table that stores the stuff that clerk doesn't (Events, Posts, Replies, etc.)
The id of a Person is the same as their clerk user id so I can easily get their user data with an api call
My first thought was going to be to put an isAdmin boolean in the person table and then in my code have something like
if( !(ownerId === userId || isAdmin) ) //obv this is psuedocode
if( !(ownerId === userId || isAdmin) ) //obv this is psuedocode
to check if the person is either the owner of the event or is an admin
If you think there's a better way user Clerk, that would be super helpful @Asian paper wasp
Oh wait clerk has a metadata feature I can probably use
@Havana Read the error and you'll figure out
Northeast Congo Lion
"use client"