xiaoshu-app/scripts/store-access-policy.mjs

// Teaching and account records are served through authenticated, scoped cloud
// functions. Public REST access would bypass the store gateway entirely.
export const STORE_PRIVATE_CLASSES = [
 '_User','_Session','Role','Manager','PlatUserRole','CommonModel','CourseBinding','CourseAppointment',
 'LessonRecord','DailyStudyRecord','PracticeRecord','CoachAvailability',
 'MemoryPracticeRecord','UnitLearningRecord','SurveyLog','UserBankAccount','UserCredit','UserDummyPoint','UserFavorite','UserCoupon','MemberNote','SysLog','UserExpDomP','UserSIcon','UserExpHis','UserUserPoint',
 'CourseCreditReservation','CreditTransaction','LessonCompletionReport','LessonReview',
 'ReviewTaskReward','ReviewRewardAdjustment','PayrollBatch','PayrollLine','PayrollAdjustment'
];
export function privateClassPermissions(previous={}) {
 return {...previous,find:{},get:{},count:{},create:{},update:{},delete:{},addField:{}};
}