How to give access to a dynamic page with author only permission?

Ask the community
, ,
1

context:

I have a collection " memberArticles " which store article. It has member content permission (create, update, read, delete only for the author).

I have a dynamic page " readArcticle/{id} " connected to that collection. Therefore an article is only readable by its author.

I would like to add a field to make an article accessible by the public (item.isPublic = true). If an article is marked has public anyone can access the page (but the author is the only one who can update/delete it)

Would it be possible to make that page readable to all via data hook and/or page router ?

2

I don’t understand from your description how you currently limit the access to this page.

3

Since it’s a dynamic page bound to a member collection, if you try to access the page it will try to query the data but that operation will return a 405 unauthorize therefor the page will not load.

Is it clearer? :slight_smile:

4

@plomteuxquentin I think so.
Well, I believe you can’t do it.
You’ll need to set the collection permission for everyone and use router to limit the access for unauthorized members.

5

Yes you will need to use router
Sample code
did not test this, i think this is how you do
let me know if you have any question
// In routers.js

import { forbidden , next } from ‘wix-router’;

export function myRouter_beforeRouter(request) {
// get the path from the request
// check if it’s the article dynamic page using the path
// and get the id else if it’s not article dynamic page return next()
// query the database with the article id
// see if the public is true
// if it’s true return next()
// if it’s not, get the user from route and check if the article _owner match
// if it’s matched return next()
// else forbidden()
if ( some_condition )
return next ();
else
return forbidden ();
}

6

@jonatandor35 If I do that the that will not be secure anymore.

I think the solution should be the opposite. Have everything as admin Only and somehow manage access to the page & data

7

Another way is to create a new collection and use the data hook to sync both artcile collection with the public collection
I think this will be a faster, but you will need to create a column with the same field key in both collection

8

Thx to @Salman help I realised that the only solution to that issue is to work with router