Monday, 13 May 2013

Best Practice for Xataface Permissions : NO ACCESS Unless ....

Xataface has a rich permissions system that offers quite a bit of flexibility in how you implement permissions.  A typical pattern for implementing permissions in Xataface is to add a "role" field to the users table to specify the user's role, and use this inside your getPermissions() methods to help determine what permissions should be granted to the user.

Many developers will take this pattern and then implement a getPermissions() method in their application delegate class similar to the following:

To summarize this strategy, it entails:

  1. Returning the permissions assigned to the current user's role (which would be defined in the permissions.ini file).
  2. Returning no permissions if either the user isn't logged in or they don't have value in their 'role' field.
While this approach may work, it could open up some security holes if you're not very careful.  Since you have defined the permissions in the application delegate class, these will be used as the default permissions for every table in the database.  If you have some tables that include private information (which will likely be the majority of your tables), you would need to explicitly provide more limited permissions on each of those tables individually by implementing getPermissions() methods in their respective delegate classes.

A Better Approach : Default NO ACCESS; Grant More As Needed

A better approach would be to grant NO ACCESS to all users, except for administrative users, at the application level.  Then you can grant additional permissions as needed at the table level.  E.g.
This grants users with a role of 'ADMIN', all permissions in the system, and no access to anyone else.

7 comments:

  1. I have two tables. One a users table and one I want anyone to see at anytime regardless of whether they are logged in or not.

    We have interns, I gave them edit permissions but I don't want them to have access to the users table. And I don't want anyone who isn't logged in to see the users table.

    SO I am following your best practices am not sure how to proceed once am ready to work in the tables directory.

    I have been through a lot of the website today and have come close to getting what I need but am about three feet from my goal.

    Can you give me a link to the part that talks about setting up permissions under the table directory?

    Thanks.

    ReplyDelete
    Replies
    1. Never mind. I just needed rest. Nailed it!

      Delete
    2. Hi everyone I'm Olivia Hannah and am here to share the wonderful work Dr Raypower did for me. After 5 years in marriage with my husband with 2 kids, my husband started acting weird and going out with other ladies and showed me cold love, on several occasions he threatens to divorce me if I dare question him about his affair with other ladies, I was totally devastated and confused until a old friend of mine told me about a spell caster on the internet called Dr. Raypower who help people with relationship and marriage problem by the powers of love spells, at first I doubted if such thing ever exists but decided to give it a try, when I contact him, he helped me cast a love spell and within 48hours my husband came back to me and started apologizing, now he has stopped going out with other ladies and his with me for good and for real. Contact this great love spell caster for your relationship or marriage problem to be solved today via email: Urgentspellcast@gmail.com or Urgentspellcast@yahoo.com or Call or WhatsApp: +14243308109. 

      Read more about him on his website: http://urgentspellcast.website2.me/














      Hi everyone I'm Olivia Hannah and am here to share the wonderful work Dr Raypower did for me. After 5 years in marriage with my husband with 2 kids, my husband started acting weird and going out with other ladies and showed me cold love, on several occasions he threatens to divorce me if I dare question him about his affair with other ladies, I was totally devastated and confused until a old friend of mine told me about a spell caster on the internet called Dr. Raypower who help people with relationship and marriage problem by the powers of love spells, at first I doubted if such thing ever exists but decided to give it a try, when I contact him, he helped me cast a love spell and within 48hours my husband came back to me and started apologizing, now he has stopped going out with other ladies and his with me for good and for real. Contact this great love spell caster for your relationship or marriage problem to be solved today via email: Urgentspellcast@gmail.com or Urgentspellcast@yahoo.com or Call or WhatsApp: +14243308109. 

      Read more about him on his website: http://urgentspellcast.website2.me/

      Delete
  2. Welcome to the forum! Very nice to meet you.

    Quincy

    ReplyDelete
  3. Hello i am here to spread this good news to the entire world on how i got my ex love back.I was going crazy when my love left me for another girl last month,But when i meet a friend that introduce me to DR IROSI the great messenger to the oracle that he serve,I narrated my problem to DR IROSI about how my ex love left me and also how i needed to get a job in a very big company.He only said to me that i have come to the right place were i will be getting my heart desire without any side effect.He told me what i need to do,After it was been done,In the next 2 days,My love called me on the phone and was saying sorry for living me before now and also in the next one week after my love called me to be pleading for forgiveness,I was called for interview in my desired company were i needed to work as the managing director..I am so happy and overwhelmed that i have to tell this to the entire world to contact DR IROSI at the following email address DRIROSISOLUTIONCENTER@GMAIL.COM and get all your problem solve..No problem is too big for him to solve..Contact him direct on DRIROSISOLUTIONCENTER@GMAIL.COM or call his mobile number or add him up on whatsapp via (+2348118829771). and get your problems solve like me.    

    ReplyDelete
  4. Hi everybody. I recently saw a testimony about chief dr lucky in a blog I visit for relationship and dating counseling problems because i had been having serious issues with my boyfriend and we had been dating for six months, he just suddenly changed, he wasn't returning my calls,he started cheating,he was hurting me in many ways i never thought possible and I just thought I should try it*maybe out of desperation of some sort*..and I contacted chief dr lucky ..At first everything felt dreamy and unbelievable, his consultations and solution was a little bit easy and strange and I was scared a little cause I heard read and heard lots of stories to of fake spell casters,scams and i never really believed in magic..I played along with a little hope and and faith and I sent some few stuffs after everything and it worked like a miracle,everything went to a while new direction,it was and is amazing...I guess it was all good faith that made me read That particular post that faithful day..I hope he could help other people too like he did me...I did a little and I got everything I wanted and wished for*my husband,my family and my life back. E-mail: Cheifdrlucky@gmail.com or contact him on whats App him +2348132777335 Website :http://chiefdrluckysolutionhome.website2.me/  

    ReplyDelete
  5. LOVE SPELLS THAT WORKS I am sharing this testimony to partners suffering in their relationships because there is an enduring solution.
    My husband left me and our 2 kids for another woman for 3 years. I tried to be strong just for my kids but I could not control the pains that torment my heart. I was hurt and confused. I needed a help, so i did a research on the internet and came across a site where I saw that Dr. Aluya a spell caster, can help get lovers back. I contacted him and he did a special prayer and spells for me. To my surprises, after some days, my husband came back home. That was how we reunited again and there was a lot of love, joy and peace in the family.
    You can as well contact Dr.  Aluya  , a powerful spell-caster for solutions on his contact aluya.48hoursspelltemple@gmail.com or directly on Whats App: +2348055431163 

    ReplyDelete