share-access
Access-control plugin for sharejs, racer and derby
Instalation
- Install:
npm install share-access
Usage
Plug in the middleware:
var shareAccess = require('share-access');
// plug in
shareAccess.setup(shareInstance);
// Or
derby.use(shareAccess);
// Or
racer.use(shareAccess);Using share-access you can control create, read, update, and delete
database operation for every collection. You can use two types of rules:
allow and deny. By default all the operations are denied. So, you should
add some rules to allow them. If at least one allow-rule allows the write, and
no deny-rules deny the write, then the write is allowed to proceed.
You can call allow and deny-rules as many times as you like. The functions
should return true if they think the operation should be allowed for allow
rules and denied for deny-rules. Otherwise they should return false, or
nothing at all (undefined).
Create
// Allow create-operation for collection 'items'
// docId - id of your doc for access-control
// doc - document object
// session - your connect session
shareAccess.allowCreate('items', function(docId, doc, session){
return true;
});
// Deny creation if user is not admin
shareAccess.denyCreate('items', function(docId, doc, session){
return !session.isAdmin;
});
// So, finally, only admins can create docs in 'items' collection
// the same results is if you just write:
shareAccess.allowCreate('items', function(docId, doc, session){
return session.isAdmin;
});Read
Interface is like create-operation
shareAccess.allowRead('items', function(docId, doc, session){
// Allow all operations
return true;
});
shareAccess.denyRead('items', function(docId, doc, session){
// But only if the reader is owner of the doc
return doc.ownerId !== session.userId;
});Delete
Interface is like create-operation
shareAccess.allowDelete('items', function(docId, doc, session){
// Only owners can delete docs
return doc.ownerId == session.userId;
});
shareAccess.denyDelete('items', function(docId, doc, session){
// But deny deletion if it's a special type of docs
return doc.type === 'liveForever';
});Update
// docId - id of your doc for access-control
// oldDoc - document object (before update)
// newDoc - document object (after update)
// path - array of update path segments - f.e = ['name'] if we are
// changing doc.name
// session - your connect session
shareAccess.allowUpdate('items', allowUpdateAll);
function allowUpdateAll(docId, oldDoc, newDoc, path, session){
return true;
}
shareAccess.denyUpdate('items', denyForNonAdmin);
function denyForNonAdmin(docId, oldDoc, newDoc, path, session){
// If you are not an admin you can change only 'description'
return !session.isAdmin && path[0] !== 'description';
}MIT License
Copyright (c) 2014 by Artur Zayats
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent