User Permission on foreign entries

[gmichel]

Hey Community and Support Team,

i love Cockpit and use it to build a SaaS application with vue.js.
Everything is working fine but my problem are the permission settings.

I hoped that an author can only get entries which he/she has inserted.
But Authors can also see and modify all entries. How to setup the permissions that the author can effect just on its entries?

Kind regards,
G.

[raffaelj]

Have a look here:

Restrict content to the content authors

I want my users to be able to view and edit only collection posts they have created. Is this something I would implement in the config file or programmatically? If so, any help would be much appreciated. Also, I will have a hidden boolean field created on each collection post only accessible by admions. Once that field is set to true only admins should be able to see/edit that post. This access to author’s own content will be more restrictive than just user groups.

Alternatively to the context rules, you can use the collections.find.before event to adjust the filter to search only for entries with _by => $user['_id'].

[gmichel]

Hey Rafael. Yes i want to start building cutom endpoints to make the application more secure.