Skip to content

Column level ACL -- Feature request #4850

Closed
@srameshr

Description

@srameshr

Issue Description

Support column level ACL to support use cases as described below.

Assume, there are 2 classes (collections) Media and Likes. The association between them is 1:n. One media can have N number of likes.

Here is some rules on Media collection:

  1. Each Media record will have it's writtenACL set to createdBy user only.
  2. Each Media record will have a relation, say likes to Likes collection.

Steps to reproduce

  1. Insert a record, say Record M1 to Media collection from User A
  2. Insert another, say Record L1 to Likes collection from User B
  3. Now without using masterKey try to add the newly insert Record L1 to the likes column in Media collection, from User B
  4. Fails with a security error.

Expected Results

Works as expected. This is more of a feature request

Actual Outcome

Hope to see column levels ACL supported.

Environment Setup

  • Server

    • parse-server version (Be specific! Don't say 'latest'.) : [2.9.x]
    • Operating System: All
    • Hardware: All
    • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): All
  • Database

    • MongoDB version: [3.x]
    • Storage engine: [S3, Mongo FS]
    • Hardware: [All]
    • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): [All]

Logs/Trace

Include all relevant logs. You can turn on additional logging by configuring VERBOSE=1 in your environment.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions