SecurityProvider - SecurityRestrict on different table

Wappler General How To
#1

I’m trying to use SecurityProvider (Database type) and SecurityRestrict in order to restrict ServerConnect action.

My DB is following
users (id, email, password) - list of users
accounts (id, title) - list of companies.
account_users (id, account_id, user_id, access) - this is user to company memberships and his role in the company. access is enum with 4 different roles (READ_ONLY, READ_WRITE, ADMIN or OWNER)

In other words, one user can belong to many companies. in every company he can play different role, and has different access - READ_ONLY, READ_WRITE, ADMIN or OWNER.

I’m trying to set up Security provider, please see screenshot. Questions:

  1. Under every role there is a possibility to have a list of conditions. Are they grouped as AND or OR?
  2. I want to put a variable in one of the conditions from DB query result.

I want to implement the following flow: user put’s his credentials on the login page, we fetch his list of accounts and take first one, then check his permission against this account and redirect to the page /accounts/{{account_id}}.
If he manually puts url with /accounts/{{account_id}} where he puts others account number he is redirected to his accounts page (I know this part is done on client side, but server side also should be protected).

image
image.png1510×1080 72.5 KB

#2

Ok, I made several tests and it looks like the following set up works:

image
image.png1492×1086 61.3 KB

So answering my questions:

  1. Looks like this rules are executed as AND in the SQL query.
  2. Although there are no picker in the “Value” field, i put manually GET parameter {{$_GET.account_id}} and seem to work.

I would love to get confirmation from Wappler product owners that my setup is correct. Authentication and Authorisation is a very sensitive topic, where you must be sure 100%.

@wappler_ambassadors, can you check this please?

1 Like
#3

Does this help?

#4

Thanks, @Hyperbytes. I saw this movie when researching teh forum.
In my situation is a bit more complex.

Actually I just want to confirm 2 things that I found experimentally - 1) that i can pass GET value as a parameter to permission condition (in the GUI there are no picker), and 2) that 2 different conditions in the list executed as AND not OR, which seems working like this.

#5

Am on the road in france at present so cant access a computer but I think I would be taking a look at the actual security file (json file) where I suspect your answers will reside. On the face of it this could well be a viable solution