Database collection permissions question

Ask the community
,
1

Hello,
I would like to add an ability for two registered users to share some content privately.
I planned to define conversations database collection to be “Private Data” collection, and add some logic at backend to verify the users are permitted to access the data.
However after publishing site I found out that my understanding was incorrect and only Admin user may access the information with Private permissions set (initially I thought backend access to the collection has Admin permissions).

  1. Is there any way to limit access to the collection to only access from backend?
  2. Is there some kind of existing database permissions I’m missing which allows me to give the ability described above?

Thanks,
Dima

1 Like
2

Hi again,
I have found some explanation on Authorization Suppression when accessing the collection from backend.
Suppression didn’t work when access was defined for “Admin” but worked in case “Site member author” permission initially set (expected?).

Basically seems it may fit my needs, however I would appreciate to know if there is more elegant/correct way to fulfill my requirement.

Thanks,
Dima

3

Hi Dima,
Sorry for the late response, it seems that what you did is the right way.
I’ll check why suppression didn’t work for the Admin role, sound like a bug.

4

Hi Tomer,
Thank you for reply. Looking forward to some update regarding Admin role issue I saw. It will allow me to ‘lock’ the collections for backend use only as I planned.
Thanks,
Dima

5

Tomer,
I would like to share with you more findings on suppression issue I have:
I see that ‘create’ permission suppression looks working correctly - I set Admin permissions on collection’s ‘create’ and adding options as following:
let options = {
“suppressAuth”: true,
“suppressHooks”: false
};
As result record is added by logged-in user as expected.

Issue is observed while querying collection with wixData.query:

  1. I set read access to ‘Admin’ and adding options above to ‘query’. I get the following error:
    The current user does not have permissions to read on the test_collection collection.
  2. I set read access to ‘Site member Author’ with same suppress options. I see that query succeeds, however it doesn’t fetch items which fit the query but were created by other users (in particular by Admin)
  3. I set ‘Site member’ role - suppression works correctly, all relevant items fetched
  4. I set ‘Anyone’ (however in this case suppression looks meaningless) - all relevant items fetched as expected.

Hopefully it will help Wix team to solve the observed issues :slight_smile:

BTW, I see that updating collection permissions will be reflected on Published site only after I press ‘Publish’, even if I didn’t make any other changes in code. Is it expected behavior? Some other way to update access permissions without Publishing site (to avoid undesired code update but only update collections permissions)

Dima

6

Hi Dima,

thank you for your report. We will investigate database permission issue.

You are correct to observe, that permissions get propagated on site publish. Currently, there is no other way to set permissions on a public site. As a workaround you could get back in history to the published site change permissions, publish the site and then get back to the latest version you were editing.

7

Hi guys,

Any update on this issue?
I still see that suppress doesn’t work when collection’s read permission set to “Admin”.

Thanks,
Dima

8

Hi Dima,

can you please provide the url of the wix website you are working on? It will help investigating the issue.

9

Hi,

Please take a look at the sample page I created to reproduce the issue:
https://dmitrybi32.wixsite.com/issue-reproduce/access-suppress

collection_1 has set “Anyone” read access.
collection_2 has “Admin” set on read access.

In both cases collection queried as following:

export function get_data(collection_name) {
let options = {
“suppressAuth”: true
};

return wixData.query(collection_name, options)
.find()
.then( (results) => {
console.log(results.items[0].title);
return results.items[0].title;
} )
. catch ( (err) => {
console.log(err);
return err.toString();
} );
}

You may observe, that reading with suppression from collection 2 results in error.

Thanks,
Dima

10

Hi Dima,

thanks for providing a code snippet. The bug lies in the way you are passing options to the query you are making with wixData.
You should not pass options object to wixData.query function. Options object should be passed to find function .

This query should work as expected:

return wixData.query(collection_name).find(options)
11

Hi Algirdas,

Thanks for help. You are right, I used options parameter incorrectly.
Passing ‘options’ to ‘find’ made it working.

BTW I used the following as reference:
http://www.wix.com/code/reference/wix-data.html#WixDataOptions
Probably worth adding here more references (examples) to functions (like find) which accept this optional parameter.

Thanks,
Dima

12

Thanks Dima! I’m passing this on to our documentation team.