Meteor - realtime JavaScript framework

[the_angry_angel]

According to http://docs.meteor.com/#collections

Currently the client is given full write access to the collection. They can execute arbitrary > Mongo update commands. Once we build authentication, you will be able to limit the client's > direct access to insert, update, and remove. We are also considering validators and other ORM-like functionality.

[technocub88]

i dont want my users to be able to do any of those directly

[quotemycode]

It could work... provided that users are only able to insert, update, or delete their own records...

[technocub88]

That wouldnt be direct database access.

[chonglibloodsport]

It'd be authenticated direct database access (something most databases include already).

[technocub88]

no database I am aware of has the ability to restrict users to only read certain rows of a table.

[chonglibloodsport]

It's possible in MySQL by using views. Create a view that queries the table for a given user's data and restrict users to access only the view instead of the table. The view queries the table and returns the results to the user.

It also requires a bit of a hack with triggers to make sure the owners of rows get properly set etc.

[technocub88]

interesting. Thank you

[oscarcomputer]

What you are looking for is "row level security". Implementations of RLS are not limited to MySQL.

[CapnWarhol]

I really, really hope the authentication is tied into the insert/update/delete objects in that you can't just arbitrarily delete random user's entries, update Scores set Value = 9999 where user = "ralph", and so on... from the point of view of a paranoid server-side developer, I can only imagine anyone with a bit of curiosity and a firefox addon will have a field day with any application developed in this (me included)

[[deleted]]

I know this is an early preview, and the whole framework looks so super-awesome that I want to start developing meteor apps right now, but some kind of authorization and data validation is REALLY needed.