Task #1331
Story #1329: ^^^^ Items To Discuss ^^^^
Possibly combine MN_crud.create() and MN_crud.update()
0%
Description
Maybe we should combine MN_crud.create() and MN_crud.update() because both take a SysMeta object that contains the obsoletes and obsoletedBy fields, and a single call could do the appropriate thing based on that information.
History
#1 Updated by Matthew Jones almost 14 years ago
I don't think so. The problem is that update() needs to enforce different access control rules than create(). Otherwise, any user could replace the content of any other user. The receiving MN should not be just trusting that the sysmeta provided by the user is right -- the MN needs to verify that the user has the rights to make those sysmeta changes. I think two distinct APIs helps to signify this critical distinction in the two operations (one creates a new object, the other creates a new object but replaces an existing object, thereby incurring an access check).
