Hello,
As a follow-up on this thread (I was considering deploying lots of instances of Apostrophe, one per customer, each of whom would have many customers), I’ve learned a good bit about Apostrophe in the mean time, and it looks as though I may have been massively overcomplicating what was necessary, and can instead do everything from a single instance / single DB.
I’m currently pursuing the path Tom mentioned of pivoting everything by siteId. This is promising, but there are two things I am still trying to suss out:
First, I am currently adding siteId in the Piece’s construct beforeSave method. This works as desired:
construct: function(self, options) {
self.beforeSave = function(req, piece, options, callback) {
piece.siteId = '5aa82645e1f36bb8032d5e31';
return callback();
};
},
I tried adding ‘hidden’ to the schema for this field, just to see if there might be an undocumented feature, but of course this didn’t do the trick. Is there a way to prevent a user from being able to see a field? I could hide the field with css targeting .apos-field-siteid, but I’d prefer something more programmatic / less hacky.
This field is something that only the application logic will ever use, and it’s better if the user isn’t even aware of it, (ideally) even if calling content via the API, though blocking it from the UI would suffice for the time being.
Second, grouping users based on siteId
I’ve done some digging here, but since the question of permissions is such an intricate one, I thought I’d just start by asking for some background. My initial thinking is structuring this something like:
'apostrophe-users': {
groups: [
{
// the siteId
title: 'manager-1234',
// a new type of 'permission', which means the user can edit pieces / pages with
// site id of 1234
permissions: [ 'edit-1234', 'etc...' ]
},
]
}
on the user doc then you would find:
{
_id: "c2s3d4g567",
username: "tom",
groupIds: ['manager-1234'],
type: "apostrophe-user"
}
Then, each time a new customer is added to my product we:
- Create a new group called “manager-theirsiteid”, and a new permission “edit-theirsiteid” which lets them edit pieces / pages with the associated Id
- Add the associated groupId “manager-theirsiteid”
So, my questions are:
- Am I thinking about this correctly?
- What am I missing?
- What functionality in which modules do I need to consider (I’m guessing apostrophe-users and apostrophe-groups are at play here)
- Do I make a my-apostrophe-users and a my-apostrophe-groups module and create my own ensureGroup function, for example, basically reimplimenting your ensureGroup function but with the customizations I need?
- To create users via REST API, I suspect I will need to access the database directly, and then call the appropriate methods from self.apos.users (or something similar)
- I also want the Users -> Manage Users list to only return users scoped to this siteId.
Thanks for any input.