-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ACL Options to Cloud Validator #6975
Conversation
Codecov Report
@@ Coverage Diff @@
## master #6975 +/- ##
==========================================
- Coverage 93.83% 93.75% -0.08%
==========================================
Files 169 169
Lines 12402 12494 +92
==========================================
+ Hits 11637 11714 +77
- Misses 765 780 +15
Continue to review full report at Codecov.
|
I believe it is a good addition but I got confused it were the ACL required to run the function or the default ACL to be applied to the objects. So I suggest changing the name of the option from 'ACL' to 'setACL' or something like this. |
@@ -733,6 +733,118 @@ function builtInTriggerValidator(options, request) { | |||
} | |||
} | |||
} | |||
const aclOptions = options.setACL; | |||
if (aclOptions && request.object && functionName === 'beforeSave.BeforeSave') { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe some error message if someone try to setACL for other function that not beforeSave?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can do!
Closing as I think #7068 will be a better approach |
Extending on the 'how to improve default security' discussion in the community forum, I thought it could be handy for the built-in cloud validator to have some ACL enforcement.
With this PR, you can add the following validation:
or
Options:
As a string:
request.user
: request.user can read + write. No public accesspublicRead
: public read + no public writepublicWrite
: no public read + public writeroleRead:roleID
: role read for roleID + no write for roleIDroleWrite:roleID
: no role read for roleID + write for roleIDroleReadWrite:roleID
:role read for roleID + write for roleIDAs an object:
override
: whether the ACL should override the request.object ACLpublic
: public ACL options. Eitherread
,write
, orreadWrite
request.user
: request.user ACL options. Eitherread
,write
, orreadWrite
role:***
: role ACL options. Eitherread
,write
, orreadWrite
userID
: userID ACL options. Eitherread
,write
, orreadWrite
Also, could it be worth allowing setting the validation object in schema, or another method (maybe the first parameter can be a validation object? If you want the validator on a class but don't care for the beforeSave logic, you'll just get:
This is another quick project for Hacktober by me, no stress if it's not appropriate for Parse!