Append allowed for non existing document

Author: bourgeoa

lib/handlers/patch.js

@@ -143,8 +143,8 @@ async function checkPermission (request, patchObject, resourceExists) {
   // Now that we know the details of the patch,
   // we might need to perform additional checks.
   let modes = []
-  // acl:default Write is required for create
-  if (!resourceExists) modes = ['Write']
+  // acl:default Write is required for create when resource exists
+  if (resourceExists) modes = ['Write']
   const { acl, session: { userId } } = request
   // Read access is required for DELETE and WHERE.
   // If we would allows users without read access,