oe-cloud modularization project
npm install oe-data-acluse * or blank for all properties.
Example for methods on relations `__create__addresses, addresses is relation name here.
`
accessType|Optional|READ, WRITE, EXECUTE, * (for all)
group|Optional|To use a mix of and and or conditions, different group value can be used to make and condition for filters. Multiple Data ACLs with in same group are always or condition. All Data ACLs with no group value are treated as a single same group.
errorCode|optional|error code to be used for data access error
$3
To use this Data ACL feature in project from this module, you should install this module.
$3
* oe-logger
* oe-cloud
$3
sh
`
$ git clone https://github.com/EdgeVerve/oe-data-acl.git
$ cd oe-data-acl
$ npm install --no-optional
$ npm run grunt-cover
`
you can find coverage report in coverage folder.
$3
To use oe-data-acl in your application, you should include this module as a dependency to your app package.json as shown below.
javascript
`
"oe-data-acl": "git+https://github.com/EdgeVerve/oe-data-acl.git#2.0.0"
`
You can also install this mixin on command line using npm install.
sh
`
$ npm install
`
$3
Once you have included this module in package.json, this module will get installed as part of npm install.TO use this in your app, you need to create entry in app-list.json file of application.
app-list.json
javascript
`
{
"path": "oe-data-acl",
"enabled": true
}
`
$3
Standard ACL for allowing WRITE access on a model to role ROLE123 is given as below
`
{
"accessType": "WRITE",
"principalType": "ROLE",
"principalId": "ROLE123",
"permission": "ALLOW"
}
`
To restrict access only where category property of the model is Books, and entry in Data ACL model can be posted.
`
{
"model": "modelABCD",
"principalType": "ROLE",
"principalId": "ROLE123",
"accessType": "WRITE",
"filter": {"category": "Books"}
}
`
The filter condition supports standard loopback conditions, which can include operators like or, and, inq etc.
Examples
`
{
"filter": {"department": {"inq" : ["d1", "d2", "d3"]}
}
`
`
{
"filter": {"or":[{"field1": "value1"},{"field2": "value2"}]}
}
`
`
{
"filter": {"and":[{"field1": "value1"},{"field2": "value2"}]}
}
`
If DataACL is not defined i.e. user can access all the data provided ACL has allows it.
$3
For dynamic values, you can use any field from standard call context fields.
Example
`
{
"filter": {"approver" : "@CC.username"}
}
`
You can either use @CC to access call context.
$3
System allows multiple Data ACLs for same model and property. In case multiple Data ACLs are applicable for a given principal, filters of all Data ACLs with no group specified are taken as OR condition.
For example following two Data ACLs will actually apply a single filter condition like category is Books or Music`.
`
`
{
"model": "modelABCD",
"principalType": "ROLE",
"principalId": "ROLE123",
"accessType": "WRITE",
"filter": {"category": "Books"}
}
{
"model": "modelABCD",
"principalType": "ROLE",
"principalId": "ROLE123",
"accessType": "WRITE",
"filter": {"category": "Music"}
}
`
$3
To use a mix of and and or conditions
For example following Data ACL combines to single filter category (Books or Music) and Country (India or Ireland)`
`
``
{
"model": "modelABCD",
"principalType": "ROLE",
"principalId": "ROLE123",
"accessType": "WRITE",
"group" : "category",
"filter": {"category": "Books"}
}
{
"model": "modelABCD",
"principalType": "ROLE",
"principalId": "ROLE123",
"accessType": "WRITE",
"group" : "category",
"filter": {"category": "Music"}
}
{
"model": "modelABCD",
"principalType": "ROLE",
"principalId": "ROLE123",
"accessType": "WRITE",
"group" : "country",
"filter": {"country": "India"}
}
{
"model": "modelABCD",
"principalType": "ROLE",
"principalId": "ROLE123",
"accessType": "WRITE",
"group" : "country",
"filter": {"country": "Ireland"}
}