List of tables by user

REST
22

Correct, I can assign the role to the user but unable to restrict the user to only the tables created by them. Ideally this should happen automatically during table creation process by the user.

23

Do you have table creation and role assignment encapsulated in a custom API service deployed to Backendless?

24

No, direct call from external system.

25

I would change that. Have one API call that is black-boxed from the outside. The API service would handle the logic for creating a table, creating the security role, and assigning the permissions for the role and the table.

26

That’s fine. All logic can be inside BL. How about the permissions issue?

27

I would design the system as described below:

  1. Prohibit access to the database from the outside. The only “party” that can be trusted would be Cloud Code, because it is indeed the only trusted environment. This can be accomplished by denying access to the database for the NonAuthenticatedUser and AuthenticatedUser roles. The only roles that can have access to the database are ServerCodeUser and any custom roles you create.

  2. In your API service perform the following actions (this assumes that a new role is created for every user):

    1. Create a custom role. This will require the usage of the Console/Admin API
    2. Create a table for the user
    3. Assign the role to the user
    4. Assign permissions between the role and the table

  3. Create a separate API service responsible for data retrieval. In that service, perform the following actions:

    1. Check if the user making the request has a corresponding role.
    2. Check if the role assigned to the user has permission to retrieve data from the table.
    3. If 1 and 2 pass, fetch data from the table and return it back to the client.

Hope this helps.

Mark