refactor(update-step): move connection authorization to model

packages/backend/src/controllers/api/v1/steps/update-step.js

@@ -5,18 +5,7 @@ export default async (request, response) => {
     .findById(request.params.stepId)
     .throwIfNotFound();
 
-  const stepData = stepParams(request);
+  step = await step.updateFor(request.currentUser, stepParams(request));
-
-  if (stepData.connectionId && (stepData.appKey || step.appKey)) {
-    await request.currentUser.authorizedConnections
-      .findOne({
-        id: stepData.connectionId,
-        key: stepData.appKey || step.appKey,
-      })
-      .throwIfNotFound();
-  }
-
-  step = await step.update(stepData);
 
   renderObject(response, step);
 };

packages/backend/src/models/step.js

@@ -335,9 +335,18 @@ class Step extends Base {
     await Promise.all(nextStepQueries);
   }
 
-  async update(newStepData) {
+  async updateFor(user, newStepData) {
     const { connectionId, appKey, key, parameters } = newStepData;
 
+    if (connectionId && (appKey || this.appKey)) {
+      await user.authorizedConnections
+        .findOne({
+          id: connectionId,
+          key: appKey || this.appKey,
+        })
+        .throwIfNotFound();
+    }
+
     if (this.isTrigger && appKey && key) {
       await App.checkAppAndTrigger(appKey, key);
     }