initial commit (#980)

Co-authored-by: Christian Beutel <>

db/routes/remote_list.go

@@ -62,6 +62,17 @@ func RemoteListGet(e *core.RequestEvent) error {
 		}
 	}
 
+	reqInfo, err := e.RequestInfo()
+	if err != nil {
+		return err
+	}
+
+	canAccess, err := e.App.CanAccessRecord(record, reqInfo, record.Collection().ViewRule)
+
+	if err != nil || !canAccess {
+		return e.ForbiddenError("forbidden", err)
+	}
+
 	return expandAndReturn(e, record, expandQuery)
 }
 

db/routes/remote_trail.go

@@ -73,6 +73,17 @@ func RemoteTrailGet(e *core.RequestEvent) error {
 		}
 	}
 
+	reqInfo, err := e.RequestInfo()
+	if err != nil {
+		return err
+	}
+
+	canAccess, err := e.App.CanAccessRecord(record, reqInfo, record.Collection().ViewRule)
+
+	if err != nil || !canAccess {
+		return e.ForbiddenError("forbidden", err)
+	}
+
 	return expandAndReturn(e, record, expandQuery)
 }
 

db/routes/remote_trail_comment.go

@@ -60,6 +60,19 @@ func RemoteTrailCommentsList(e *core.RequestEvent) error {
 		return err
 	}
 
+	reqInfo, err := e.RequestInfo()
+	if err != nil {
+		return err
+	}
+
+	filteredRecords := []*core.Record{}
+	for _, record := range records {
+		canAccess, _ := e.App.CanAccessRecord(record, reqInfo, record.Collection().ListRule)
+		if canAccess {
+			filteredRecords = append(filteredRecords, record)
+		}
+	}
+
 	// 3. Get total count for pagination metadata
 	var totalItems int
 	err = e.App.DB().
@@ -73,7 +86,7 @@ func RemoteTrailCommentsList(e *core.RequestEvent) error {
 
 	// 4. Handle Expand
 	if expandQuery != "" {
-		errs := e.App.ExpandRecords(records, strings.Split(expandQuery, ","), nil)
+		errs := e.App.ExpandRecords(filteredRecords, strings.Split(expandQuery, ","), nil)
 		if len(errs) > 0 {
 			fmt.Printf("Expand errors: %v\n", errs)
 		}
@@ -85,7 +98,7 @@ func RemoteTrailCommentsList(e *core.RequestEvent) error {
 		"perPage":    perPage,
 		"totalItems": totalItems,
 		"totalPages": (totalItems + perPage - 1) / perPage,
-		"items":      records,
+		"items":      filteredRecords,
 	})
 }
 
@@ -171,16 +184,3 @@ func syncRemoteComments(e *core.RequestEvent, trail *core.Record) error {
 		return nil
 	})
 }
-
-func expandAndReturnList(e *core.RequestEvent, records []*core.Record, query string) error {
-	if query != "" {
-		expandPaths := strings.Split(query, ",")
-
-		errs := e.App.ExpandRecords(records, expandPaths, nil)
-		if len(errs) > 0 {
-			fmt.Printf("Expand errors: %v\n", errs)
-		}
-	}
-
-	return e.JSON(http.StatusOK, records)
-}