FastAPI – Easily create robust, standardized API endpoints in Rails and Postgres

Re:FastAPI – Easily create robust, standardized API endpoint... by Glyptodon on Monday July 28, 2014 @03:32PM (#8098873)

I don't think there's actually a good way to solve this (that I know of) for applications with complex enough permission and role hierarchies.

Once you need a list of all the glass marbles with their attributes, but can only see the color of marbles you supervise, and only the radius of a marble if it has a shooter role and only the names and emails of marbles ranked above you... ...and so on... it becomes a situation where each result has to be filtered item by item pretty much. And the filter hierarchies will snowball like tribbles.

[ Parent | on HN ]

Re:FastAPI – Easily create robust, standardized API endpoint... by lumpypua on Monday July 28, 2014 @04:37PM (#8099197)

The `djangorestframework-composed-permissions` package for DRF gets pretty close to handling this situation effectively. Basically roles and permissions arbitrarily composable with boolean expressions.

Although you can model permission hierarchies, I think there are enough corner cases that it's worthwhile to declare permissions as explicitly as conveniently possible.

API Docs: https://djangorestframework-composed-permissions.readthedocs...

[ Parent | on HN ]

Re:FastAPI – Easily create robust, standardized API endpoint... by cheald on Monday July 28, 2014 @08:08PM (#8100012)

View models/decorators have served me very well in this case. The view model would take the marble instance, viewing user instance, etc and decide which attributes it should emit as JSON. The result is frequently very clean, very maintainable code.

[ Parent | on HN ]