Monday, 13 May 2013

Best Practice for Xataface Permissions : NO ACCESS Unless ....

Xataface has a rich permissions system that offers quite a bit of flexibility in how you implement permissions.  A typical pattern for implementing permissions in Xataface is to add a "role" field to the users table to specify the user's role, and use this inside your getPermissions() methods to help determine what permissions should be granted to the user.

Many developers will take this pattern and then implement a getPermissions() method in their application delegate class similar to the following:

To summarize this strategy, it entails:

  1. Returning the permissions assigned to the current user's role (which would be defined in the permissions.ini file).
  2. Returning no permissions if either the user isn't logged in or they don't have value in their 'role' field.
While this approach may work, it could open up some security holes if you're not very careful.  Since you have defined the permissions in the application delegate class, these will be used as the default permissions for every table in the database.  If you have some tables that include private information (which will likely be the majority of your tables), you would need to explicitly provide more limited permissions on each of those tables individually by implementing getPermissions() methods in their respective delegate classes.

A Better Approach : Default NO ACCESS; Grant More As Needed

A better approach would be to grant NO ACCESS to all users, except for administrative users, at the application level.  Then you can grant additional permissions as needed at the table level.  E.g.
This grants users with a role of 'ADMIN', all permissions in the system, and no access to anyone else.

17 comments:

  1. I have two tables. One a users table and one I want anyone to see at anytime regardless of whether they are logged in or not.

    We have interns, I gave them edit permissions but I don't want them to have access to the users table. And I don't want anyone who isn't logged in to see the users table.

    SO I am following your best practices am not sure how to proceed once am ready to work in the tables directory.

    I have been through a lot of the website today and have come close to getting what I need but am about three feet from my goal.

    Can you give me a link to the part that talks about setting up permissions under the table directory?

    Thanks.

    ReplyDelete
    Replies
    1. Never mind. I just needed rest. Nailed it!

      Delete
    2. Hi everyone I'm Olivia Hannah and am here to share the wonderful work Dr Raypower did for me. After 5 years in marriage with my husband with 2 kids, my husband started acting weird and going out with other ladies and showed me cold love, on several occasions he threatens to divorce me if I dare question him about his affair with other ladies, I was totally devastated and confused until a old friend of mine told me about a spell caster on the internet called Dr. Raypower who help people with relationship and marriage problem by the powers of love spells, at first I doubted if such thing ever exists but decided to give it a try, when I contact him, he helped me cast a love spell and within 48hours my husband came back to me and started apologizing, now he has stopped going out with other ladies and his with me for good and for real. Contact this great love spell caster for your relationship or marriage problem to be solved today via email: Urgentspellcast@gmail.com or Urgentspellcast@yahoo.com or Call or WhatsApp: +14243308109. 

      Read more about him on his website: http://urgentspellcast.website2.me/














      Hi everyone I'm Olivia Hannah and am here to share the wonderful work Dr Raypower did for me. After 5 years in marriage with my husband with 2 kids, my husband started acting weird and going out with other ladies and showed me cold love, on several occasions he threatens to divorce me if I dare question him about his affair with other ladies, I was totally devastated and confused until a old friend of mine told me about a spell caster on the internet called Dr. Raypower who help people with relationship and marriage problem by the powers of love spells, at first I doubted if such thing ever exists but decided to give it a try, when I contact him, he helped me cast a love spell and within 48hours my husband came back to me and started apologizing, now he has stopped going out with other ladies and his with me for good and for real. Contact this great love spell caster for your relationship or marriage problem to be solved today via email: Urgentspellcast@gmail.com or Urgentspellcast@yahoo.com or Call or WhatsApp: +14243308109. 

      Read more about him on his website: http://urgentspellcast.website2.me/

      Delete
  2. Welcome to the forum! Very nice to meet you.

    Quincy

    ReplyDelete
  3. Hello i am here to spread this good news to the entire world on how i got my ex love back.I was going crazy when my love left me for another girl last month,But when i meet a friend that introduce me to DR IROSI the great messenger to the oracle that he serve,I narrated my problem to DR IROSI about how my ex love left me and also how i needed to get a job in a very big company.He only said to me that i have come to the right place were i will be getting my heart desire without any side effect.He told me what i need to do,After it was been done,In the next 2 days,My love called me on the phone and was saying sorry for living me before now and also in the next one week after my love called me to be pleading for forgiveness,I was called for interview in my desired company were i needed to work as the managing director..I am so happy and overwhelmed that i have to tell this to the entire world to contact DR IROSI at the following email address DRIROSISOLUTIONCENTER@GMAIL.COM and get all your problem solve..No problem is too big for him to solve..Contact him direct on DRIROSISOLUTIONCENTER@GMAIL.COM or call his mobile number or add him up on whatsapp via (+2348118829771). and get your problems solve like me.    

    ReplyDelete
  4. Hi everybody. I recently saw a testimony about chief dr lucky in a blog I visit for relationship and dating counseling problems because i had been having serious issues with my boyfriend and we had been dating for six months, he just suddenly changed, he wasn't returning my calls,he started cheating,he was hurting me in many ways i never thought possible and I just thought I should try it*maybe out of desperation of some sort*..and I contacted chief dr lucky ..At first everything felt dreamy and unbelievable, his consultations and solution was a little bit easy and strange and I was scared a little cause I heard read and heard lots of stories to of fake spell casters,scams and i never really believed in magic..I played along with a little hope and and faith and I sent some few stuffs after everything and it worked like a miracle,everything went to a while new direction,it was and is amazing...I guess it was all good faith that made me read That particular post that faithful day..I hope he could help other people too like he did me...I did a little and I got everything I wanted and wished for*my husband,my family and my life back. E-mail: Cheifdrlucky@gmail.com or contact him on whats App him +2348132777335 Website :http://chiefdrluckysolutionhome.website2.me/  

    ReplyDelete
  5. LOVE SPELLS THAT WORKS I am sharing this testimony to partners suffering in their relationships because there is an enduring solution.
    My husband left me and our 2 kids for another woman for 3 years. I tried to be strong just for my kids but I could not control the pains that torment my heart. I was hurt and confused. I needed a help, so i did a research on the internet and came across a site where I saw that Dr. Aluya a spell caster, can help get lovers back. I contacted him and he did a special prayer and spells for me. To my surprises, after some days, my husband came back home. That was how we reunited again and there was a lot of love, joy and peace in the family.
    You can as well contact Dr.  Aluya  , a powerful spell-caster for solutions on his contact aluya.48hoursspelltemple@gmail.com or directly on Whats App: +2348055431163 

    ReplyDelete
  6. I completely trusted Dr Osofo totally from the time I spoke with him during the period my husband Left me after 7 years of our marriage, He started the spell work on my husband, and gave me so much assurance and guaranteed me that he was going to bring my husband back to my feet in just 48 hours of the spell casting. I was so confident in his work and just as he said in the beginning, my husband is finally back to me again, yes he is back with all his hearts, Love, care, emotions and flowers and things are better now. I would have no hesitation to recommend this powerful spell caster to anybody who is in need of help.. E-mail; (osofo.48hoursolutioncenter@gmail.com )  Or add him up on whatapps; +2349065749952

    ReplyDelete
  7. I completely trusted Dr Osofo totally from the time I spoke with him during the period my husband Left me after 7 years of our marriage, He started the spell work on my husband, and gave me so much assurance and guaranteed me that he was going to bring my husband back to my feet in just 48 hours of the spell casting. I was so confident in his work and just as he said in the beginning, my husband is finally back to me again, yes he is back with all his hearts, Love, care, emotions and flowers and things are better now. I would have no hesitation to recommend this powerful spell caster to anybody who is in need of help.. E-mail; (osofo.48hoursolutioncenter@gmail.com )  Or add him up on whatapps; +2349065749952

    ReplyDelete
  8. I want to use this great opportunity to thank Dr Aluya for helping me to get my boyfriend back after 3 months of breakup. My boyfriend breakup with me because he see another girl at his working place and told me he is no longer interested in me and live me in pain and heart break. I seek for help on the internet and i saw so many good talk about this great spell caster Dr Aluya and I contacted him also and explain my problems to him and he cast a love spell for me which i use to get back my boyfriend within the period of 48 hours and i am so grateful to him for the good work he did for me,that is why i also want to let everyone who is in need of help out there to also seek help from him so he can help.His email is aluya.48hoursspelltemple@gmail.com or whatsapp: +2348110493039

    ReplyDelete
  9. My name is Louis Edmond, I am from USA. I want to share a testimony about Dr Aluya, a great spell caster who is very straight forward with his words of casting spells. When my Wife left me for another Man i was so confused,but one a day a friend of mine gave me the email address of this great spell caster called dr Aluya, I contacted this man and explained to him all that i was going through,he then told me to be calm and not worry anymore because my case is a very easy one. At first I never believed all that he was saying until when my husband returned home two days later begging me to forgive him for all that he had done to me and to please accept him back into my life,I was so amazed,I never believed it was going to happen that fast.
    This man is truly great indeed. Contact him today for a perfect solution to your love problem, aluya.48hoursspelltemple@gmail.com.  or whatsApp him  +2348110493039

    ReplyDelete
  10. My first time meeting with a Psychic medium and I have to say, it's really worth it. It had been 5months since my husband left me without saying anything.All thanks to Dr Okiti I was able to connect with my husband again with his powerful reunion love spell and now he loves me more than he used to. Eternally grateful with The Great Dr Okiti I highly recommend, His email l :Okitilovespelltample@gmail. com

    ReplyDelete
  11. Hi everyone, my name is Rabueil Islam
     and am from London, I met this spell caster called Dr Aluya of aluya.48hoursspelltemple@gmail.com online and so many other, but i decided to go with this particular spell caster and this is about 2 weeks ago. I needed the spell caster to reunite me and my lover because she started behaving strange and a day came she text me and told me she cannot continue with the relationship anymore, that she just want to be alone. But a close friend of hers shows the guy to me that she was now dating. So i contacted this spell caster because i was totally heart broken and i smoked and get drunk till i could not even notice if am standing or lying.This spell caster told me not to worry, he gave me hope that am to have her again just like old times, and i provided all the requirements, and in just 5 days, my ex lover called me crying over the phone asking for me to forgive her for her stupid act, and she swore with her mother grave to love me and never hurt me again.This was what the spell caster earlier told me and it came after he has done the spell and that same night, my lover came to my house and spend the night with me.I have never seen spell as powerful as this but now, am convinced that Dr Aluya is the best ever, You can contact him through him email address:aluya.48hoursspelltemple@gmail.com or WhatsApp: +2348110493039

    ReplyDelete
  12. My lover dumped for  another woman with two kids i was confused until i came
    in contact with Dr Aluya who helped me with a powerful love spell that
    brought him back within 2 days. contact Dr Aluya for help on :
    Email :aluya.48hoursspelltemple@gmail.com or WhatsApp him  +2348110493039

    ReplyDelete
  13. Get Your Wife Back, Perfect Urgent Love Spell. Am Oliva Giphy
     from FL Usa All Thanks To Dr Aluya Who Brought Back The Love Of My Life. my girlfriend cheated on me and asked for a breakup. I don't believe at first i try to get back with her but all she told me was she’s with someone else. that she is no longer interested in marrying me at that point i was heart broken coz i love my girlfriend so much that i could not let go off her all of a sudden she left me, i really love her and never can imagine my life without her. not until i came across a powerful real spell caster Dr Aluya who promise me 48hours urgent love spell to get back with my girlfriend, good twenty-four {48} hours. hmm-mm, it was a good night time at 11:pm within the days that Dr Aluya told me that my girlfriend will be back, at first i heard the bell rings getting close to my door i heard someone saying honey!!!, it sound familiar i opened the door and i saw my girlfriend standing and weeping in front of me. i was not surprised because its all i have been praying for her to come back home. Guess what 2 weeks after she noticed her system and her body temperature was changed and i took her to clinic for check up and the doctor told me that there is life in her which means she was pregnant i really wants to use this opportunity to thanks Dr Aluya so much and the love page that directed me to Dr Aluya if you have any problem getting your ex back, or predicament that is worse or exactly like this you have been into, contact Dr Aluya on aluya.48hoursspelltemple@gmail.com Whatsapp/cal  +2348110493039  
    https://draluya48hoursspelltemple.webs.com/

    ReplyDelete
  14. My lover dumped another woman with two kids i was confused until i came
    in contact with Dr Aluya who helped me with a powerful love spell that
    brought him back within 2 days. contact Dr Aluya for help on :
    Email :aluya.48hoursspelltemple@gmail.com or aluya.48hoursspelltemple@yahoo.com WhatsApp him +2348110493039


    website https://draluya48hoursspelltemple.webs.com/

    ReplyDelete
  15. How I Got My Ex Husband Back..Am so excited to share my testimony of a real spell caster who brought my husband back to me. My husband and I have been married for about 6 years now. We were happily married with two kids, a boy and a girl. 3 months ago, I started to notice some strange behavior from him and a few weeks later I found out that my husband is seeing someone else. He started coming home late from work, he hardly care about me or the kids anymore, Sometimes he goes out and doesn't even come back home for about 2-3 days. I did all I could to rectify this problem but all to no avail. I became very worried and needed help. As I was browsing through the internet one day, I came across a website that suggested that Dr Aluya can help solve marital problems, restore broken relationships and so on. So, I felt I should give him a try. I contacted him and and told him my problems and he told me what to do and i did it and he did a spell for me. 48 hours later, my husband came to me and apologized for the wrongs he did and promise never to do it again. Ever since then, everything has returned back to normal. I and my family are living together happily again.. All thanks to Dr Aluya Powerful Love Spell that really works. If you have any problem contact him and i guarantee you that he will help you. He will not disappoint you. Email him at: {aluya.48hoursspelltemple@gmail.com}. or  {aluya.48hoursspelltemple@yahoo.com} whatsapp him on: +2348110493039  
      https://draluya48hoursspelltemple.webs.com/  

    ReplyDelete