make createdAt read only

[ebarault]

hey,

the requirement is the following:

• createdAt property is public and available in remote methods for a given model
• user is allowed rights on some create/update methods on that model
• createdAt property should not be altered by the user through those remote methods

currently i'm using a fork from the ds-readonly mixin to have this somehow working but the way it is implemented conflict with the behavior of ds-timestamp mixin for some of the remote methods like replaceById/updateById : readonly mixin first removes the createdAt property from the request body then the timestamp mixin create a new value for createdAt property

this requirement should be handled directly by the timestamp mixin to avoid such conflicts

has this already been discussed here?

[clarkbw]

This hasn't been discussed before. I could see the before save method trying to actively prevent users from changing the createdAt field, something it doesn't do right now. As well the upadatedAt field is always written by this mixin so it is already effectively read-only however more protections could be added.

[clarkbw]

And its interesting to see that people have forked my repo for other mixin purposes.

[ebarault]

yes, updatedAt is not that much of a problem right now for the aforementioned reason.
tell me if i can help, as i need a similar feature anyhow

[mrfelton]

I've created an updated version of https://github.com/fullcube/loopback-ds-readonly-mixin/ that I believe addresses this issue. In this, updates to existing properties that are marked as readonly will retain their existing values on update.

@ebarault can you check that this works for your use case please? Thanks!

[amismailz]

@mrfelton It is working using Read-only mixin. But I noted that setting read only true or false has the same effect is this normal?

"ReadOnly" : {
    "createdAt" : true // false has the same effect
}

[webees]

@amismailz I encountered the same situation as you，loopback-ds-readonly-mixin Did not work properly，If "Remote methods" is added, it is invalid.