3 ms·
I'm not the right person to answer all of these (the post author is). I'll do my best on what I can. For permissions, there are five levels of users. System,
by JoelSutherland 16y ago
I'm not the right person to answer all of these (the post author is). I'll do my best on what I can.
For permissions, there are five levels of users. System, Agency, Site Owner, Member, Public. These are hierarchical like everything else. Group members and individual users can have varying read/write/create permissions for different areas of the content tree.
This is all at the API level. So someone logged in will have the same permissions whether they are browsing the frontend of the site, the administration UI or using the API. This is nice, tidy and easy to understand.
As for XHR vs not...
In the Admin UI, we're doing most work through the API via XHR and JS templates. On the public site of things, everything happens server side just like any other CMS.
- StavrosK 16y agoThanks, I'm just wondering because, even though this approach had fantastic advantages, there also seem to be some things which are done differently in an API. For example, the API might use OAuth after logging the user in with credentials, so this is a case where things are done differently in the two approaches. In this case, does one simply write two ways of doing things? You might also not want to let the users do things with the api that they can do on the site, or give different permissions to the site versus the API. How do you handle these things?