Security News
Cloudflare Adds Security.txt Setup Wizard
Cloudflare has launched a setup wizard allowing users to easily create and manage a security.txt file for vulnerability disclosure on their websites.
@startupjs/sharedb-access
Advanced tools
npm install @startupjs/sharedb-access
yarn add @startupjs/sharedb-access
const shareDbAccess = require('sharedb-access')
new shareDbAccess(backend[, options])
backend
- your ShareDB backend instanceoptions
(optional) - object with options:
options.dontUseOldDocs
: false - if true don't save unupdated docs for update actionoptions.opCreatorUserIdPath
- path to 'userId' for op's metaUsing sharedb-access
you can control create
, read
, update
, and delete
database operation for every collection. You can use two types of rules:
allow
and deny
. By default all the operations are denied. So, you should
add some rules to allow them. If at least one allow
-rule allows the write, and
no deny
-rules deny the write, then the write is allowed to proceed.
You can call allow
and deny
-rules as many times as you like. The functions
should return true
if they think the operation should be allowed for allow
rules and denied for deny
-rules. Otherwise they should return false
, or
nothing at all (undefined
).
// Allow create-operation for collection 'items'
// docId - id of your doc for access-control
// doc - document object
// session - your connect session
backend.allowCreate('items', async (docId, doc, session) => {
return true
})
// Deny creation if user is not admin
backend.denyCreate('items', async (docId, doc, session) => {
return !session.isAdmin
})
// So, finally, only admins can create docs in 'items' collection
// the same results is if you just write:
backend.allowCreate('items', async (docId, doc, session) => {
return session.isAdmin
})
Interface is like create
-operation
backend.allowRead('items', async (docId, doc, session) => {
// Allow all operations
return true
})
backend.denyRead('items', async (docId, doc, session) => {
// But only if the reader is owner of the doc
return doc.ownerId !== session.userId
})
Interface is like create
-operation
backend.allowDelete('items', async (docId, doc, session) => {
// Only owners can delete docs
return doc.ownerId === session.userId
})
backend.denyDelete('items', async (docId, doc, session) => {
// But deny deletion if it's a special type of docs
return doc.type === 'liveForever'
})
// docId - id of your doc for access-control
// oldDoc - document object (before update)
// newDoc - document object (after update)
// ops - array of OT operations
// session - your connect session
const allowUpdateAll = async (docId, oldDoc, newDoc, ops, session) => {
return true
}
backend.allowUpdate('items', allowUpdateAll);
FAQs
Sharedb access-control midleware
The npm package @startupjs/sharedb-access receives a total of 67 weekly downloads. As such, @startupjs/sharedb-access popularity was classified as not popular.
We found that @startupjs/sharedb-access demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Cloudflare has launched a setup wizard allowing users to easily create and manage a security.txt file for vulnerability disclosure on their websites.
Security News
The Socket Research team breaks down a malicious npm package targeting the legitimate DOMPurify library. It uses obfuscated code to hide that it is exfiltrating browser and crypto wallet data.
Security News
ENISA’s 2024 report highlights the EU’s top cybersecurity threats, including rising DDoS attacks, ransomware, supply chain vulnerabilities, and weaponized AI.