balek / share-access Goto Github PK

var shareAccess = require('share-access');

// plug in
shareAccess.setup(shareInstance);
// Or
derby.use(shareAccess);
// Or
racer.use(shareAccess);

// Allow create-operation for collection 'items'

// docId - id of your doc for access-control
// doc   - document object
// session - your connect session

shareAccess.allowCreate('items', function(docId, doc, session){
  return true;
});

// Deny creation if user is not admin
shareAccess.denyCreate('items', function(docId, doc, session){
  return !session.isAdmin;
});

// So, finally, only admins can create docs in 'items' collection
// the same results is if you just write:

shareAccess.allowCreate('items', function(docId, doc, session){
  return session.isAdmin;
});

shareAccess.allowRead('items', function(docId, doc, session){
  // Allow all operations
  return true;
});

shareAccess.denyRead('items', function(docId, doc, session){
  // But only if the reader is owner of the doc
  return doc.ownerId !== session.userId;
});

shareAccess.allowDelete('items', function(docId, doc, session){
  // Only owners can delete docs
  return doc.ownerId == session.userId;
});

shareAccess.denyDelete('items', function(docId, doc, session){
  // But deny deletion if it's a special type of docs
  return doc.type === 'liveForever';
});

// docId - id of your doc for access-control
// oldDoc  - document object (before update)
// newDoc  - document object (after update)
// path    - array of update path segments - f.e = ['name'] if we are 
//           changing doc.name
// session - your connect session

shareAccess.allowUpdate('items', allowUpdateAll);

function allowUpdateAll(docId, oldDoc, newDoc, path, session){
  return true;
}

shareAccess.denyUpdate('items', denyForNonAdmin);

function denyForNonAdmin(docId, oldDoc, newDoc, path, session){
  // If you are not an admin you can change only 'description'
  return !session.isAdmin && path[0] !== 'description';
}