javascript - How to secure blueprint access in Sails.js -

so i'm pretty new sails.js seems bring lot table these blue prints,

right have 2 models, accounts / friends

it using association accounts has many friends

on client side have way send notifications users, 1 being friends request works fine, gives user option accept or decline invite

here's code:

socket.on('accounts', function(data) {     if (data.verb === "addedto" && data.attribute === "notifications") {       socket.get('/notifications/' + data.addedid, function(note) {         console.log(note);         if (!$.isemptyobject(note)) {           $scope.notifications.push({             'text': note.from_name + ' sent friends request',             'id':   note.id,             'type': note.type,             'from_id': note.from_id           })           $.notify('you have new notification', 'info');           $scope.$digest();         }       })     }   })  $scope.accept = function(notificationid, fromid) {  } 

when people press accept button, want add friend both person accepted notification, , person sent it's mutual , they're both friends each other.

i making data object , doing socket.post friends both of them, , doing socket.put update notification being read , deal away it

the problem is, don't want people come in , open js console , spam socket.post million friends people maliciously

var obj {   'friend_name': 'bill',   'online': 1 }  socket.post('/accounts/1/friends', obj); 

so, how can secure people accessing post /accounts/1/friends people should accessing this?

if i'm not making sense ask. thanks!

example of being spammed:

somebody opens js console , goes

var obj = { friend_name: 'bill', owner: 1 }; io.socket.post('/friends', obj);

500 times account id 1 has 500 friends named bill

correct me if misunderstood think logic wrong.

i assume bill account, when add name don't have connection account information , can identify him name. in order have kind of validation need unique identifier of bill. instead of name can add account_id , owner.

so if there 3 accounts:

1. chris
2. bill
3. joe

you add var obj = { account_id: 2, owner: 1 };

so way can check policies if friend account_id , owner exists before adding new friend. if have questions how use policies ask.

anyway think better approach have 1 model , many many relationship model alone. account have many many relationship through third table sails create (that friends table). way in new table have 2 columns contain account ids. if let's on first row have ids 1 , 2, means chris , bill both friends , can think of logic make sure rows unique don't have problem spam. record haven't done many many relationship 1 model have figure out how it's done.