Five functions decide who may read a row in our app, and the answer for somebody else's row is 404
Nakodo is a Next.js app with two halves. One half is 76 public pages that show the same thing to everybody, like how it works and pricing . The other half is behind a login and every row in it belongs to exactly one account. All of the second half's access control lives in one file, src/lib/auth.ts , 87 lines including comments. Thirty-seven files import it. There are five functions that answer…
The Nakodo app contains two halves: public pages accessible to all and a private section for individual accounts. All rows in the private section correspond to a single account. The access control for the private section resides in a single file, src/lib/auth.ts, consisting of 87 lines of code. This file includes five functions that determine whether a request can access a particular row.
The most noteworthy aspect is the behavior when a request is denied access. For some requests, a 404 response is returned, indicating that the requested row does not belong to the currently signed-in user.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
