ACL in Customer Console

[Doug Black]

I want to use the customer console for an app that has multiple users. How do I make sure that each user only has access to their information?

[Illya Stepanov]

Hi Doug,

The customer will be able to edit or view the database data only if access rights were provided by developer. So, its up to the architecture of your database and access control policy that you have created.

[Doug Black]

Thanks. However, I logged in today with a test login and it allowed me access to everyone's information. Any thoughts how to fix this?

[Illya Stepanov]

What was access rights to this test login? Can you show us? We will test this.

[Igor]

We got your email, but I'm not sure what names you hadn't put there. Could you show us screenshot?

[Kateryna Grynko]

Hi Doug,

Did you solve this?

[Doug Black]

Sure, I'll do so in a bit. Thanks.

[Doug Black]

Here are the first eight names, none of which I entered.

[Evgene Karachevtsev]

Hello Doug,

The customer console doesn't work as you want. When owner application creates customer console he chooses database where customer credentials are stored (name it "database_with_users"). And then in "collection settings" grants access to collections which can in be different databases. And if owner grants "Can view" access to collection (for example collection "streets") every user from database "database_with_users" can view all rows from collection "streets". In this case even "acl" restrictions don't work.

[Carlota]

Hi Appery.io support team!
So, it is not possible to use Customer Console for multiple user access; so each user has access to different Collections, right?
I mean, user1 access Collection 1 only; user2 access Collection 2 only; and so on.
Thank you in advance!
Carlota F: