added comment about allowing id

gmmorris · Aug 21, 2020 · 96689fa · 96689fa
1 parent c58689a
commit 96689fa
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/...ns/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts b/...ns/encrypted_saved_objects/server/saved_objects/encrypted_saved_objects_client_wrapper.ts
@@ -60,6 +60,10 @@ export class EncryptedSavedObjectsClientWrapper implements SavedObjectsClientCon
     // Saved objects with encrypted attributes should have IDs that are hard to guess especially
     // since IDs are part of the AAD used during encryption, that's why we control them within this
     // wrapper and don't allow consumers to specify their own IDs directly.
+
+    // only allow a specified ID if we're overwriting an existing ESO with a Version
+    // this helps us ensure that the document really was previously created using ESO
+    // and not being used to get around the specified ID limitation
     const canSpecifyID = options.overwrite && options.version;
     if (options.id && !canSpecifyID) {
       throw new Error(
@@ -111,7 +115,7 @@ export class EncryptedSavedObjectsClientWrapper implements SavedObjectsClientCon
           );
         }
 
-        const id = object?.id ?? generateID();
+        const id = object.id ?? generateID();
         const namespace = getDescriptorNamespace(
           this.options.baseTypeRegistry,
           object.type,