Ninety-nine Pitchers of Malt

    sharedb-secure

    0.2.1 • Public • Published

    ShareDB Secure

    Access and schema control for ShareDB and DerbyJS

    Installation & Usage

    npm install sharedb-secure

    const derby = require('derby');
    const options = require('examples/options');
    const sharedbSecure = require('sharedb-secure');
     
    let backend = derby.createBackend();
    sharedbSecure(backend, options);
     
    let model = backend.createModel();
    model.socket.stream.checkServerAccess = true; // If you want to check access on the server side

    Upgrade 0.1.x to 0.2.0

    Server queries was added. You must provide serverQuery to options or set options.allowRegularQueries to true.

    Features

    Library provide access controll for create, read, update and delete oprations with ShareDB in DerbyJS application.

    • Allow to read only several fields for some user group
    • Disallow to read whole collections for another group
    • Allow only create but not update operations on any of fields for any colelction for any user group
    • Schema validation with Z-Schema
    • Server queries with disallowed regular queries

    Server queries

    First, you should provide serverQuery property for your collection. Key is query name, value - function which must create real query object.

    You can return an error in first argument.

    Thanks to https://github.com/dmapper/server-query

    Be aware of just passing params to real query and check it to be a strings, objects, arrays or what you need.

    Example:

    // options
    serverQuery: {
        test: function (params, req, next) {
            return next(null, {title: '' + params.p1});
        },
    }
    
    // Call
    model.query('collection', {
        $serverQuery: 'test',
        $params: {p1: 'some string'}
    });
    

    Options

    You may view example options in example directory. Options is a JavaScript Object with keys:

    collections

    Each key is collection name. Value is below.

    collections.*.schema

    Z-Schema schema for the collection items.

    collections.*.getRole

    Function with arguments (docId, doc, session, req, next). Should return string role name by calling next(null, 'role')

    docId - the document ID for which the role is requested.

    doc - the document body for which the role is requested. doc is null for op calls

    session - current session object.

    req - current request object.

    collections.*.roles

    Each key is role name which returned from getRole function. If role is not provided access will be denied.

    collections.*.roles.*.[create|read|update].*.fields

    Array with allowed fields for create or read or update.

    For read not allowed fields will be cut off from snapshots and ops.

    If agent try to create or update not allowed field - error will be throwed.

    May be set to ['*'] for allow operation on all fields.

    collections.*.roles.*.[create|read|update|delete].*.check

    Callback function with arguments (docId, doc, session, req, next) for create, read and delete. Arguments for update is (docId, oldDoc, newDoc, session, req, next).

    For read operation doc may be null for op operations.

    You can set check:true is you don not to check any values.

    If function is not provided access will be denied.

    collections.*.serverQuery

    An object with keys - query names, and values - functions (params, req, next).

    Function calls when server query executed for collection.

    options.godRole

    String. If this role will be returned from getRole access will be granted without any checks. Just for developers or super-admins or gods.

    options.allowRegularQueries

    Allow regular queries. Default to false

    Set true if you do not need to secure user queries.

    zschema.options

    Options for Z-Schema constructor.

    zschema.formats

    Object with additional formats for Z-Schema. Key is format name, value is function.

    MIT License

    Copyright (c) 2019 Valery Ozarnichuk

    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

    Install

    npm i sharedb-secure

    DownloadsWeekly Downloads

    3

    Version

    0.2.1

    License

    MIT

    Unpacked Size

    53.4 kB

    Total Files

    6

    Last publish

    Collaborators

    • iakumai