Question: I am building Node JS, Express with TypeScript api, where I want to get the data stored by a particular user. I want to get the reocrd from mongodb based on user ID.

My DataRouter.ts

```
router.get('/:userId', Data.findByUserId);

```

My Service.ts

```
async findByUserId(id: string): Promise<IRecord[]> {
        try {
            return await DataModel.find({userId: id});
        } catch (error) {
            throw new Error(error.message);
        }
    },

```

My DataComponent

```
export async function findByUserId(req: Request, res: Response, next: NextFunction): Promise<void> {
    try {
        const record: IData[] = await DataService.findByUserId(req.params.id);

        res.status(200).json(record);
    } catch (error) {
        next(new HttpError(error.message.status, error.message));
    }
}

```

and my IRepository.ts

```
findByUserId(id: string): Promise<T[]>;

```

I am getting the error

> 
> HttpError: Cast to ObjectId failed for value
> "auth0|5fa05bf7657a9f006f9be77d" at path "\_id" for model "DataModel"
> 
> 
> 

I will be very thankful if someone has experience it, and share your knowledge.

Answer: 
You need to understand the difference between user consent and admin consent:

Each application registers permissions it requires. Some permissions can be granted by users, some other only by the administrator.

Let's suppose you have only permissions that can be consented by users. The first time they use the application, they'll be prompted (each user) to consent those permissions to the application. If in the same scenario you click on `grant admin consent`, it is the equivalent of accepting it for all users on the tenant.

> 
> Can the admin limit their consent to my app AND my user account? I.e.
> can azure be configured such that only me (as the developer) can use
> my application with the granted permission? Is that what "user
> assignment" means in the azure documentation?
> 
> 
> 

Yes, this is the "**user assignment**" mentioned in the document. As I said in the answer, admin consent is at the tenant level. If you grant admin consent to the application, it is the equivalent of accepting it for all users on the tenant. If you need to restrict the application to a certain set of users, then you can set to：[restrict the Azure AD application to a set of users in the Azure AD tenant](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-restrict-your-app-to-a-set-of-users).

> 
> Let's assume my app gets the TeamMember.ReadWrite.All permission with
> admin consent. I hope that still means that the usual user
> restrictions are in place. For example, a normal user will still not
> be able to add members to a team they do not own, right?
> 
> 
> 

Yes, if you only assign an application to specific users, other users will not be able to use the application to add members.
This may be relevant to the last question:

> 
> * For delegated permissions, the effective permissions of your app are the least-privileged intersection of the delegated permissions the app has been granted (by consent) and the privileges of the currently signed-in user. Your app can never have more privileges than the signed-in user.
> * For application permissions, the effective permissions of your app are the full level of privileges implied by the permission. For example, an app that has the User.ReadWrite.All application permission can update the profile of every user in the organization.
> 
> 
> <https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#permission-types>
> 
> 
>