Securing Pages and APIs

It is important for a permission model to secure pages and APIs. In ES the extension developers can secure pages and APIs through a permission check, by specifying a permission property when mapping the endpoints.

Follow the two examples shown below to understand how ES supports the securing of pages and APIs.

Example 1

Users need to be restricted from viewing and performing specific actions on a page. The following example illustrates how a user is only given permission to access the Create page, which is done when the ASSET_CREATE permission key is assigned as the value for permission.

To know more about the permission keys in ES, see Permission Keys.

The permission property can be specified for API or page endpoints that are defined in the app and asset extensions.

asset.server=function(ctx){
  vartype=ctx.type;return{
    endpoints: {
      apis: [
        {
          url: 'assets',
          path: 'assets.jag'
        },
        {
          url: 'asset',
          path: 'asset.jag'
        },
        {
          url: 'statistics',
          path: 'statistics.jag'
        }
      ],
      pages: [
        {
          title: 'Asset: '+type,
          url: 'asset',
          path: 'asset.jag'
        },
        {
          title: 'Assets '+type,
          url: 'assets',
          path: 'assets.jag'
        },
        {
          title: 'Create '+type,
          url: 'create',
          path: 'create.jag',
          permission: 'ASSET_CREATE'
        }

Example 2

Here the create page shown in Example 1 will be secured through dynamic permission. A function is mapped as the value for permission instead of a permission key, which will be evaluated when checking whether a user has access to a given page.

{
             title: 'Create '+type,
             url: 'create',
             path: 'create.jag',
             permission: function(ctx){
        return ‘/permission/’+ctx.type+’/mycreatepermission’;
  } 
}