Parse-dashboard: Read-Only Capability
Hi,
For the past few weeks, my friends and I have been working on designing a version of parse-dashboard in which we enabled read-only access to certain apps for certain users. In the config file, the owner now has the option of granting users not just full access to certain apps, but read-only access to some apps, in which the user isn't able to write to the app. We now have a working prototype of this version of parse-dashboard, and we were wondering what the best way would be to push these changes to the community, or if there was a revision process that the community does prior to uploading changes. Please let me know how this would work. Thank you very much!
nakulshn
All 13 comments
Just a quick question, how do you enforce the readonly access?
flovilmart
on 14 Jul 2017
We modified the config file to account for users having read-only access to certain apps, and then based on which user is logged in, we modified the UI to display either a read-only interface or a full access interface for the app. Right now we have the UI level enforcing the read-only access, but we are currently working on adding server level protection as well.
nakulshn
on 14 Jul 2017
I believe this should start with the server then enforcing it client side will be easy.
flovilmart
on 14 Jul 2017
You can probably introduce, a readMasterKey for people who want that capability, then it鈥檚 easy to use that key instead
flovilmart
on 14 Jul 2017
Yes, that's what we were thinking as well, we were just wondering what the process is to push the changes to the community.
nakulshn
on 14 Jul 2017
We welcome changes to the main repositories through pull requests and after thorough evaluation of the code that鈥檚 been pushed. In your case, I鈥檓 enclinded to move forward with the server enforcing read only access but not client based restrictions as it gives a false sense of security
flovilmart
on 15 Jul 2017
Sounds good! We'll work on adding server level protection and then contact you
nakulshn
on 15 Jul 2017
Also, be careful about respecting coding style, architecture etc... when merging a pull request we take the responsibility to maintain your feature afterwards so also be prepared to have to perform nits, and changes, moreover that this is quite a big feature
flovilmart
on 15 Jul 2017
Hi! So we've looked into adding server level protection through a readMasterKey, and we were wondering, wouldn't we have to edit the parse-server code in order to give each app a distinct readMasterKey in addition to its masterKey? If we do have this, how would we go about editing that code? And if we don't have to do this, how would we go about giving each app a readMasterKey? Any help would be appreciated. Thank you!
nakulshn
on 27 Jul 2017
Yes this would require a new readMasterKey, one that would bypass ACL / and CLP's for read but will never allow writes. And yes this has to be implemented in parse-server.
flovilmart
on 27 Jul 2017
Hi Flovilmart,
I have been working on understanding how masterKey works and how Parse-Server and Parse-dashboard implement it in order to bypass all ACL/CLPs. I understand the theory of how masterKey works, and how readOnlyMasterKey will accomplish what we want it to, I'm just confused on how/where parse uses masterKey. I was wondering if you could give any advice on how to approach this readOnlyMasterKey problem, in terms of specifics. This would be really helpful to my team and me, as none of us have very much experience with back end and client-server interactions. Also, since I don't have very much experience with this area, I was wondering, what would, in your opinion, be most valuable to learn to accomplish this task. Thank you!
nakulshn
on 8 Aug 2017
Is there a way to turn parse-dash read-only right now? Just to view data I know you won't trigger any afterSave functions by mistake.
I found this weird bug... double-clicking on an object inside a cell, and highlighting the object. then deselecting the cell...causes the entire object to resave. Check the image!
@flovilmart
@nakulshn
alexrmacleod
on 4 Oct 2017
it's now part of the latest release parse-server 2.6.5 and parse-dashboard 1.1.1, please refer to the documentation and changelogs in order to deploy this
flovilmart
on 26 Oct 2017
Related issues
robertherber
路
6Comments
monajafi
路
4Comments
oligazar
路
7Comments
gianpaj
路
5Comments
SamuelEshetu
路
5Comments
Most helpful comment
Hi! So we've looked into adding server level protection through a readMasterKey, and we were wondering, wouldn't we have to edit the parse-server code in order to give each app a distinct readMasterKey in addition to its masterKey? If we do have this, how would we go about editing that code? And if we don't have to do this, how would we go about giving each app a readMasterKey? Any help would be appreciated. Thank you!