3 ms·
I like how when building REST API servers and clients there are standard components that just works. The entire API in the same format means it is easy to write
by meric 11y ago
I like how when building REST API servers and clients there are standard components that just works. The entire API in the same format means it is easy to write a DSL across the entire API configure each endpoint - such as row level and field level permissions, pagination, filtering. If you have a well designed RPC you have the same benefit, but except with REST - you can reuse someone else's work because the design is the same. It literally takes 20 seconds to change the /user/ endpoint so:
1. Non-authenticated users can create users, and see a list of users with details that are public.
2. Authenticated users can view their own public and private details and have read/write access to most fields except is_staff.
3. Staff users have full permissions for users that belong to the country they are managing.
4. Superusers have access to everything.
Without the benefit of DSLs this would take hours to write all the if/else statements and unit test them. It would be a nightmare to do the same for all your endpoints. I assume you can write some abstraction functions to use for all your RPC endpoints but it'd be easier to reuse a library from past projects that had the same REST API design.
Example:
Row level:
permission_classes = [
Or(And(Or(IsOwner('id'), IsStaff), IsUpdateOnly),
And(AllowAny, IsReadOnly),
And(AllowAny, IsCreateOnly))]
Field level:
is_public = And(IsActive, Is('is_public', True))
fields = {
'display_name': [],
('is_active', 'password', 'email'): [
Or(is_staff_or_owner, IsCreateOnly)
],
('full_name', 'slug',): [
Or(is_staff_or_owner, is_public, IsCreateOnly)
]
}