I have an endpoint that is publicly available (accessed by a webpage). Now, I would like to be able to update a certain field of the requested item without having to give the public user overall “write” permissions to that collection. I also do not want to do any authentication because it seems unnecessary. In a way it is not the public user who makes this change but rather “the system”.

This is a minimal example which does (obviously) not work because the accountability of the request is passed on and therefore does not have the required permissions to do the update.

export default (router, { services }) => {
  router.get('/getItem/:id', async (req, res) => {
    const itemssService = new services.ItemsService('items', { schema: req.schema, accountability: req.accountability })
    const item = await itemsService.readOne(req.params.id)
    await itemsService.updateOne({
      id: req.params.id,
      last_access: new Date()
    })
    res.send({ item })
  })
}

I am suspecting that my approach might not be best practise but I cannot think of a good alternative. If I understand correctly, emitting an event or calling an action does not “upgrade” permissions in any helpful way. Or am I wrong?