{"action":"opened","issue":{"url":"https://api.github.com/repos/orionjs/core/issues/48","labels_url":"https://api.github.com/repos/orionjs/core/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/orionjs/core/issues/48/comments","events_url":"https://api.github.com/repos/orionjs/core/issues/48/events","html_url":"https://github.com/orionjs/core/issues/48","id":64102846,"number":48,"title":"Property-level access control on entities","user":{"login":"vonwao","id":377000,"avatar_url":"https://avatars.githubusercontent.com/u/377000?v=3","gravatar_id":"","url":"https://api.github.com/users/vonwao","html_url":"https://github.com/vonwao","followers_url":"https://api.github.com/users/vonwao/followers","following_url":"https://api.github.com/users/vonwao/following{/other_user}","gists_url":"https://api.github.com/users/vonwao/gists{/gist_id}","starred_url":"https://api.github.com/users/vonwao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vonwao/subscriptions","organizations_url":"https://api.github.com/users/vonwao/orgs","repos_url":"https://api.github.com/users/vonwao/repos","events_url":"https://api.github.com/users/vonwao/events{/privacy}","received_events_url":"https://api.github.com/users/vonwao/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-24T21:23:01Z","updated_at":"2015-03-24T21:23:01Z","closed_at":null,"body":"I offer an idea to add a function on entities to determine if a property has Read or Write access for the current user. Here is an example for a hypothetical Event entity, which has some public properties, some config properties, and some read-only properties:\r\n\r\n```javascript\r\ncheckPropertyAccess: function(propName, accessType) {\r\n    accessTypes = []; \r\n    configurationProps = ['invitationEmailTemplate', \"reminderEmailTemplate\"]\r\n    readOnlyProps = ['rsvpYesReplies', 'rsvpNoReplies', 'rsvpMaybeReplies']\r\n    //grant READ access depending on property and role\r\n    if (!configProps.contains(propName) || currentUser.hasRole('ADMIN') || this.eventAdmins.contains(currentUser.id)) {\r\n      accessTypes.push('READ') \r\n    }\r\n    //grant WRITE access if eventAdmin, for all except readOnly props\r\n    if (this.eventAdmins.contains(currentUser.id) && !readOnlyProps.contains(propName)) {\r\n      accessTypes.push('WRITE')\r\n    } \r\n    //grant superuser WRITE access to any prop\r\n    else if (currentUser.hasRole('ADMIN')) {\r\n      accessTypes.push('WRITE')\r\n    }\r\n    return accessTypes.contains( accessType);\r\n  }\r\n```\r\n\r\nNote: this is pseudo-code, I don't know how to access the currentUser or how to define roles, etc."}}