2

Most of the following is done with the parse-dashboard so it's a bit wordy, but I understand the code just not the relationships.

I'm setting Parse.Roles and it seems like each individual Parse.Object needs to have the Role set to have access to a given Parse.Object. For example, an Object ACL needs to contain both "Admin" and "Moderator" (with respective permissions) for Admins or Moderators to have access.

Since parent and child roles are possible, it would make sense to set a Parse.Object's ACL with the "Organization" Role, which is then further modified by the child Role. So, a "Viewer" within an "Organization" cannot Write, but an "Admin" within the "Organization" can Read/Write. I've tried multiple ways of doing this - associating one user to a "Viewer" and one to an "Admin" within an "Organization" but this does not seem to work.

My Current Solution: To manually/programmatically set each Parse.Object ACL with multiple pre-set Roles. E.g. Parse Class "Person" with ACL Roles "Viewer" & "Admin".

Question: If I want to create a different Role in the future for this same Organization, will I need to loop through each Parse.Object and manually set the new Role for each of the past Objects?

It would make sense that these relationships should be managed by the parent Organization so that this doesn't need to be done manually, but this doesn't seem to work.

Any answers, thoughts, or links are appreciated.

4

1 回答 1

4

正如您所提到的，角色可以拥有角色并继承其父角色的权限。

因此，如果新角色适用于一个类或一组对象的所有对象，则无需遍历所有解析对象。

我给你举个例子：

假设您有一个名为 Posts 的类。

  • 你有一个角色名字viewer，你有一个角色名字editor。

  • 当您创建一个新的帖子对象时，您将添加两个角色viewer并editor作为帖子对象的 ACL。例如，查看者角色只能具有读取权限，而编辑者可能同时具有读取和写入权限。

对于每个组织：

  • 首先，您创建一个角色名称uniqueOrganizationName
  • 然后将属于该组织的所有用户添加到uniqueOrganizationName用户（关系）。

现在，将来，如果您想将该组织的所有用户添加到例如editorRole，而不是添加editorRole到所有用户对象，您可以添加uniqueOrganizationName到editorRole角色。现在，该组织的所有用户都可以修改所有帖子。如果您希望组织的某些用户能够编辑帖子，您可以将这些用户添加到editorRole用户中。

注意：这种方法是全局的。因此组织编辑可以编辑所有帖子对象。如果您想限制组织的编辑者只能编辑属于该组织的帖子：

  • 为每个组织创建两个独特的角色viewUniqueOrganizationRole& editUniqueOrganizationRole。

现在，当您创建新帖子时，根据该帖子所属的组织，您将viewUniqueOrganizationRole&&添加editUniqueOrganizationRole到帖子对象的 ACL。

  • 在此之后，您可以添加用户以便viewUniqueOrganizationRole能够查看属于该组织的帖子，或者您可以添加用户editUniqueOrganizationRole以便他们可以编辑您的帖子。

我希望我能回答你的问题。这是一个复杂的设计。

于 2018-09-30T17:03:11.997 回答