I use the 2 custom policies for almost every Strapi backed project I create. One policy is for single owner and the other policy is for a multiple owners field.
isOwner.js
isOwners.js
Place these files in ~/config/policies/ to be available globally and then set them per route. For example I have a binders content type and my ~/api/binders/config/routes.js begins like the following:
{
"routes": [{
"method": "GET",
"path": "/binders",
"handler": "binder.find",
"config": {
"policies": [
"global::isOwners"
]
}
},
...
The specific attributes that relate to this usage defined on the content type in ~/api/binder/models/binder.setting.json are the following:
"private": {
"type": "boolean",
"default": true
},
"owners": {
"plugin": "users-permissions",
"collection": "user",
"via": "binders",
"dominant": true
},
"readonly": {
"plugin": "users-permissions",
"collection": "user",
"via": "binders_readonly",
"dominant": true
}