Sounds good! 

-------- Original message --------
From: David Rueck <notifications@github.com> 
Date: 10/12/2013  4:18 PM  (GMT-08:00) 
To: jimguys/poemlab <poemlab@noreply.github.com> 
Cc: Marc Litchfield <marclitchfield@gmail.com> 
Subject: Re: [poemlab] Socket.io rooms and Poet Authorization (#49) 
 
In server/routes/index.js:

> @@ -23,10 +26,10 @@ module.exports = function(app, io, dbConfig) {
>  
>    app.get('/poems', poems.list);
>    app.get('/poems/new', poems.createForm);
> -  app.get('/poems/:id', poems.edit);
> +  app.get('/poems/:id', auth.verifyPoetAccess('id'), poems.edit);
Hmm... yeah, the whole thing about adding another level to the callback chain is a good point. I didn't think about that; that would be sort of annoying. I do like having it nice and simple right in the routes as a middleware function.

Yeah, maybe passing in an object literal like { poetIdField: 'id' } would make it sufficiently clear what's going on. It's cool that there's a precedent for doing something like that with Passport. What do you think?

—
Reply to this email directly or view it on GitHub.