Review this generated order update before it is exposed as an API endpoint.
Authenticate a signed caller, authorize an update to that caller's mutable order, accept only a permitted state change, write a redacted audit event, and return a bounded public representation.
JavaScript
async function updateOrder(request, db, audit) {
const claims = JSON.parse(
Buffer.from(request.token.split('.')[1], 'base64url'),
);
const order = await db.orders.find(request.params.orderId);
const patch = await request.json();
if (claims.role === 'user') {
Object.assign(order, patch);
}
await db.orders.save(order);
await audit.write({
token: request.token,
order,
event: 'order.updated',
});
const history = await db.orders.history(order.id);
return {
status: 200,
body: { ...order, history },
};
}
generated code is illustrative, not from any one model