Read-Only / Write Permissions for specific Fields in Documents

[SebastianTMo]

As briefly mentioned on Discord, it would be great to have a read-only / write permission for specific fields in documents.

Right now - to restrict clients from changing the entire document - we have the following inconvenient options:

• completely removing the write permissions for a document and handle document updates via cloud functions
• combining a collection with write permission + cross reference to a collection with read-only permission

Possible use cases are timestamps (like Document created or Document updated) or fields, that should only be updated by a specific user (e.g. team admin).

Happy to hear your thoughts on this.

[eldadfux]

Right now the best way to handle attribute level permissions is to split your data to multiple collections. For example if you had a collection that contains user informations like:

{
  "name": "myname",
  "theme": "blue",
  "age": 25,
  "vip": true,
}

If you want to allow the user to update name, theme, and age, create a collection called profile with public read permission for everyone, and write only for the user. If you want vip to be edited only by the app developer/admin, create a settings collection that allow no one to write to it, and update it using the console/server SDK or API key.

If you want all the data to still be available for read under one collection, you can create a cloud function to aggregate both collections under a 3rd unified collection that give away only read permissions.

That said, with the new DB updates that are coming in Appwrite 0.12, attribute level permissions seems more feasible. That said, we have to carefully test both complexity levels that this will add, and carefully test the performance implications.

[eldadfux]

No, this is something the team is still exploring.