appwrite / appwrite/appwrite

🚀 Enhancement: Client: set permission scope

Open
#8,085 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
TypeScript
Stars
57.4k
Forks
5.7k
Avg merge
14h 50m
Merged PRs (30d)
276

Description

### 🔖 Enhancement description

The API should be able to execute actions in the context of a (different) user's permissions. This could be implemented by adding a method to `Client`:

```typescript
Client.setPermissionScope = (role: Role): Client => {}
```

### 🎤 Pitch

Never trust a user. This should be the guiding factor when designing app security. Hence, it makes sense to disable services for the client. Doing so can prevent data scraping and partly hacker's interference by providing contextual, minimal APIs using Functions.

Appwrite offers a granular permissions system, which would help a lot in order to further harden security, in conjunction with locking down services and only providing minimal Function APIs. However, disabled services aren't available to Functions either when executing actions with a user session, even though they are executed in a controlled environment.

Hence, I would like a way to make use of all of a Functions amenities while also respecting permissions. E.g. it should be simple to check if a logged in user (via JWT?) has the permission to delete a document or file, and the operation should fail if not.

See [this Discord discussion](https://canary.discord.com/channels/564160730845151244/1233871128204808293/1233871128204808293) for context.

Further, this functionality could be useful to admins or moderators who want to see their site (e.g. a Dashboard, Forum, etc.) with different permissions applied. A switch between views could easily be implemented by just changing the permission scope and user's role from `admin` to `user` or similar.

### 👀 Have you spent some time to check if this issue has been raised before?

- [X] I checked and didn't find similar issue

### 🏢 Have you read the Code of Conduct?

- [X] I have read the [Code of Conduct](https://github.com/appwrite/.github/blob/main/CODE_OF_CONDUCT.md)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.