Closed
Description
Issue Description
Support column level ACL to support use cases as described below.
Assume, there are 2 classes (collections) Media
and Likes
. The association between them is 1:n
. One media can have N number of likes.
Here is some rules on Media
collection:
- Each
Media
record will have it's writtenACL
set tocreatedBy
user only. - Each
Media
record will have arelation
, saylikes
toLikes
collection.
Steps to reproduce
- Insert a record, say
Record M1
toMedia
collection fromUser A
- Insert another, say
Record L1
toLikes
collection fromUser B
- Now without using
masterKey
try to add the newly insertRecord L1
to thelikes
column inMedia
collection, fromUser B
- Fails with a security error.
Expected Results
Works as expected. This is more of a feature request
Actual Outcome
Hope to see column levels ACL supported.
Environment Setup
-
Server
- parse-server version (Be specific! Don't say 'latest'.) : [2.9.x]
- Operating System: All
- Hardware: All
- Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): All
-
Database
- MongoDB version: [3.x]
- Storage engine: [S3, Mongo FS]
- Hardware: [All]
- Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): [All]
Logs/Trace
Include all relevant logs. You can turn on additional logging by configuring VERBOSE=1 in your environment.
Metadata
Metadata
Assignees
Labels
No labels