When writing server code, what is the proper syntax for forming an updateObject action that requres a token?

[Garrett]

I been all over this page http://docs.appery.io/documentation/backendservices/server-code/ but still no luck. I even provide my master key and I still get "Access denied: you don’t have write permission on specified object".

I am using server code to update a particular field in a collection that has the ACL enabled.

Am I missing something?

code
updatedSettings = {
"X-Appery-Session-Token": "xxxxxxxxxxxxxxxxxxxxxxxxxxxx", &#47;&#47;<--- master key
"FieldToBeUpdated": "updated value"
}

Collection&#46;updateObject("xxxxxxxxxxxxxxxxxxxxxxxx", "CollectionnName", "objectID", updatedSettings);
/code

I have also tried to use this to get a token instead of using the master key...

code
var token = DatabaseUser&#46;login(DB_id, userName, userPass)&#46;sessionToken;
/code

[Alena Prykhodko]

Hello Garrett!

Working on it..

[Alena Prykhodko]

Try the following:
code
var responseBody = {},
requestParams = {};

Code: Select all

 updatedSettings = { 

"X-Appery-Session-Token": "xxxxxxxxxxxxxxxxxxxxxxxx",
"FieldToBeUpdated": "updated value"
}

Collection&#46;updateObject("xxxxxxxxxxxxxxxxxxxxxxxx", "CollectionName ", "objectID ", updatedSettings);
responseBody&#46;requestBody = request&#46;body();
responseBody&#46;requestParams = requestParams;
console&#46;log(responseBody);
response&#46;success(responseBody, "application&#47;json");/code

Database Id 'xxxxxxxxxxxxxxxxxxxxxxxx' is invalid. It must be hexadecimal number with accurate length in 24 characters, please define it.
Also CollectionName and objectID should be replaced with values.

[Garrett]

I am using a good database ID (I just put x's in the field for posting on the forum).

I am using a good collection name (I just replaced it in my post).

The objectID is a good one (I just replaced it for posting in this forum).

I have the ACL for the targeted object set to read/write for the originator and read only for "*" .

I have tried both my master database key as the token and a token derived from...
codevar token = DatabaseUser&#46;login(DB_id, userName, userPass)&#46;sessionToken;/code
using the targeted object's originator.

Assuming I use the method you listed and correct terms (token, collection, DB_ID, and accurate targeted fields) I get the same error...

"Access denied: you don’t have write permission on specified object".

Bottom line, it does not work.

[Garrett]

Any word on this one?

[Illya Stepanov]

Sorry no news -- working on it.

[Maryna Brodina]

Hello!
1) at this moment it's not possible to make a request from server code to DB with master-key. As a workaround you can use XHR api.
2) you have to send session token as 5th parameter of updateObject method (not as object property with data for updating). See http://docs.appery.io/documentation/b...

[Garrett]

Very good. I read through that document, but failed to put it together that the token goes in the actual call of the method instead of as part of the object.

Thank you!

[LukeM]

not possible to make a request from server code to DB with master-key.

is this still an issue?

[Alena Prykhodko]

No, everywhere you can send a token, you can send master key.