5 ms·
What about fine grain permissions such as a certain user can only see public fields of other users or you can only change your vote after 10 minutes? Opening up
by sebringj 10y ago
What about fine grain permissions such as a certain user can only see public fields of other users or you can only change your vote after 10 minutes? Opening up the data model may work in many cases but seems like it just brings up other paradigms in its place.
- avitzurel 10y agoEasily solvable with GraphQL and Falcor. The biggest challenge here would be to keep your resolvers stateless, but it's doable.
- joesb 10y ago> such as a certain user can only see public fields of other users In Graphql, the solution is usually to return `null` for restricted field. This is arguably better security than raising unauthorized exception, since attacker can't differentiate having no permission to having no data. > You can only change your vote after 10 minutes This in done in mutable action, which can have permission check inside.
- sebringj 10y agoRight, other paradigms in its place. Exactly.