✅ Profile validators
Profile routes compose shared SDK guards in source order. Validators are route guards, not Express middleware; their canonical contracts are documented in Common and Identity. Profile exports no validator of its own, so this page records the shared guards and their exact Profile route compositions; it deliberately contains no implementation source excerpt.
Inventory
| Validator | Reads | Success condition | Failure / error | Consumers |
|---|---|---|---|---|
isAuthenticated() | context.authenticate, or Bearer fallback | selected adapter resolves | adapter error propagates | Every Profile route |
checkIdentityType(['admin']) | auth adapter, db.identities, configured type IDs | caller has configured admin type | setup 500, token 401, authorization 403 | All routes except identity lookup |
isSelf(...) | configured payload path, token identity ID | IDs match | 401 invalid token; 403 missing/mismatch | Create Profile and identity lookup |
ownsProfile(...) | db.profiles, configured profile ID, token identity | caller owns requested profile | 400, 401, 403, or 500 | Profile-resource routes |
some(...validators) | child validators | one child succeeds | first collected child error if all fail | All routes except the two list routes |
Route compositions
| Guard order | Routes |
|---|---|
isAuthenticated(), then some(checkIdentityType(['admin']), isSelf(['params', 'requestBody', 'identityId'])) | createProfileRoute |
isAuthenticated(), then some(checkIdentityType(['admin']), ownsProfile(['params', 'requestParams', 'profileId'])) | getProfileRoute, updateProfileRoute, deleteProfileRoute, getAvatarUploadUrlRoute, createProfileFollowRoute, deleteProfileFollowRoute, getProfileFollowersRoute, createOrganizationFollowRoute, deleteOrganizationFollowRoute, createProductLikeRoute, and deleteProductLikeRoute |
isAuthenticated(), then checkIdentityType(['admin']) | findProfilesRoute |
isAuthenticated(), then isSelf(['params', 'requestParams', 'identityId']) | findProfilesByIdentityIdRoute |
Details
isAuthenticated()
Implementation
Signature: isAuthenticated(): Validator. It runs first on every Profile route and invokes context.authenticate(payload) or the getBearerTokenInfo Bearer fallback. It does not inspect the returned token information; an adapter rejection propagates. See the canonical Common validator contract and the exact consumers in Route compositions.
checkIdentityType(['admin'])
Implementation
Signature: checkIdentityType(['admin']): Validator. It requires db.identities and configuration.identity.typeIds, authenticates the request, loads the caller identity, and compares its typeId with configuration.identity.typeIds.admin. Missing setup is 500; an invalid user token is 401; a failed identity lookup, missing type ID, or unauthorized type is 403. It is direct on the administrator-only profile list and a child of some(...) on the other applicable routes; some(...) starts its children concurrently. See Route compositions.
isSelf(...)
Implementation
Signature: isSelf<T extends string>(identityIdPathInPayload: [T, ...T[]]): Validator. createProfileRoute supplies ['params', 'requestBody', 'identityId']; findProfilesByIdentityIdRoute supplies ['params', 'requestParams', 'identityId']. It requires a valid user token and compares the configured value with its identityId; an invalid token is 401, while a missing or nonmatching target is 403. See Identity validators and Route compositions.
ownsProfile(...)
Implementation
ownsProfile is the SDK's partial application of ownsResource for the profiles collection and the resource owner path ['identityId']. Each Profile consumer supplies ['params', 'requestParams', 'profileId']. It requires a valid user token, db.profiles, and that path's profile ID; it loads the profile and succeeds only when profile.identityId equals the token identity ID. Failures are 401 invalid token, 500 missing profiles collection, 400 missing profile ID, or 403 for a database error, missing owner, or ownership mismatch. Its consumers are listed in Route compositions.
some(...validators)
Implementation
Signature: some(...args: Validator[]): Validator. It runs all child validators concurrently and succeeds when at least one fulfills. If none do, it throws the first collected NodeblocksError in child order; an unknown rejection becomes 500 Unknown error. The Profile routes use an administrator-or-owner branch, except createProfileRoute, whose alternative branch is isSelf(...). See the canonical Common validator contract and Route compositions.