Hello,
I have checked Appery doc and tutorials but haven't yet found some sort of straightforward explanation how to set permissions to database collections.
In my scenario I have one collection to which all users must be given "read" permission and only one user who will be given both "read" and "write" permissions.
As far as I was able to learn it looks like that:
1) By default all collections except 'users' collection have their permissions set to "read" and "write" to all users.
2) Each collection has 'acl' field in which you can put permissions in JSON format like this:
{"*":{"read":true},"userID":{"read":true,"write":true}}
By doing so you will effectively limit the users' permissions.
So it is developer's job to:
1) define which user will be granted which permission.
2) update the 'acl' column of all object which permissions must be limited.
In my scenario, where I have quite small collection about 800 objects, I need to update 'acl' field of each object. Right?
If I am right then what is the best way to do it? Doing it manually is of course no option. I have considered the following approaches:
1) import the collection with 'acl' already preset in CSV file. This seemed the easiest way (copy the row it in Excel) but unfortunately it fell through because JSON permission string contains commas, which of course will break the structure of imported data.
2) run update query via Appery admin panel - this failed to, because there is only one update method available (single object update). You can not set "multi' flag like in this example:
db.collection.update( { "_id" : { $exists : true } }, objNew, upsert, true);
see here http://stackoverflow.com/questions/41...
3) run update from application editor - this is the approach suggested by Appery support in one of posts:
a) first run query service with 'where' criteria or just list service returning all objects.
b) then iterate through all results via data variable and Javascript, and set the value for each object.
So please tell me if I am right as to setting permissions?
I do not want all users to have write permissions to some of my db collections, for obvious reasons.
And is there any other approach to update 'acl' column, preferably faster and simpler than the ones outlined by me above?
I will be thankful for you guidance and any hints helping me and future Appery users to do it in the right way.