Folder Security

Folder security is used to set defaults for any file or page that shares a relative path. The definitions are read from the WebServer table as the rest of the definitions. The requirements are Type="Settings" and Url must have a value. The Code field can then be either a JSON definition or a DQL. The security setting can be recursive, meaning that if we do not get a exact match further down the tree, the recursive higher up in the url tree will be the rule.

JSON security definition

The definition must be a object with the following settings:

recursive	is this folder definition recursive
alllevel	set all the levels to this before going to the individuals (this is called before all the others, so you can set all, then override one or two)
readlevel	the level needed for reading in this folder
updatelevel	the level needed for updating in this folder
createlevel	the level needed for creating in this folder
deletelevel	the level needed for deleting in this folder
dqlcode	the dql that will return the security level for the url
devserver	settings that will override for the development server. If you want something to be allowed when you develop, you can set it using the same structure as the main setting
server	settings that will override for the live server. If you want something to be different when you run live then the development, you can set it using the same structure as the main setting

Values that can be used for the settings

None	No security, all allowed to use the resource.
Low3	Low3 and up are allowed to use the resource.
Low2	Low2 and up are allowed to use the resource.
Low1	Low1 and up are allowed to use the resource.
Medium3	Medium3 and up are allowed to use the resource.
Medium2	Medium2 and up allowed to use the resource.
Medium1	Medium1 and up allowed to use the resource.
High	Only High users are allowed to use the resource.
Deny	No access, no user allowed to use the resource. This is also the default if you add a setting and do not set a value.

You set the URL to /mydoc/ then then the code below and it will be the minimum requirements for all pages below this level regardless of what is set on the page. If a page has stricter settings, that will be used, if it has more lenient settings, this will be used.

{
  "recursive" : true,
  "readlevel" : "Medium2",
  "updatelevel" : "High",
  "createlevel" : "Medium2",
  "deletelevel" : "High"
}

This will make all paths from /mydoc and below have a minimum of the set security.

You set the URL to /definition/ and then just recursive to true, you basically denies all api access to all tables. You can still make pages that manipulate the tables using dql. If you want to allow just on table for manipulation, you can do that with a specific rule for that url. See next example.

{
  "recursive" : true
}

This will deny all use of ajax call for reading and writing tables.

You set the URL to /definition/Document then this will set the access to manipulate just this table

{
  "readlevel" : "Low3",
  "updatelevel" : "Low1",
  "createlevel" : "Medium2",
  "deletelevel" : "Deny"
}

This is a specific setting for one table, and will override the deny all from above. This will let all with Low3 and higher read, any with Low1 or higher to update and any with Medium2 or higher to create new record and nobody to delete anything. If the table has settings that requires higher security that will over ride this settings.

Advanced example that set different rules for development and live server

DQL security definition

You must start the code wit .dql for the setting to recognize this as a dql. The dql will use Remote for communication with the server. A remote session named "Security" is created and clear before the dql is started. The value "what" is set to tell the type of security we are after and "url" with the path to the element in question. You then return "result" with "yes" or "no" to tell if the request is granted or not.

.dql

Example of a dql that tests user and level and grant the the rights to folders based on that.