32 ms·
One thing I’m not finding in this or similar tools is how to do row level authorization. For example: imagine a “forms” table. Users can submit forms and see
by shireboy 6y ago
One thing I’m not finding in this or similar tools is how to do row level authorization. For example: imagine a “forms” table. Users can submit forms and see and edit “their” forms, but not those of other users. Users need GET/POST/PUT /forms based on a UserId field in forms.
A more complex scenario: employees can submit forms. Managers can see forms for their employees, but not those of other managers. Managers need GET/POST/PUT on /forms based on forms.userid AND a relationship defined in manager_employees table. Managerid is not stored in forms because it could change.
Almost every api I’ve ever written has something along those lines. How would that be accomplished in a tool like this?
- xgenecloud 6y agoWe provide simple role based ACL mechanism (toggleable from CLI/GUI) https://docs.xgenecloud.com/en/v0.5/rest-apis/rest-acl https://docs.xgenecloud.com/en/v0.5/rest-apis/rest-acl However, this simple ACL is not intended to encompass all business rules or hierarchies of every application. Hence we decided to provide each router (or controller) with its own middleware handler where these rules can be coded easily. Explained in below diagram : https://docs.xgenecloud.com/en/v0.5/rest-apis/rest-acl#workflow https://docs.xgenecloud.com/en/v0.5/rest-apis/rest-acl#workf...