would be cool to have just one acl rule for 1 collection
how this will be added to
POST /coll, PUT /coll/doc and PATCH /coll/doc
or is it working actually ?
another more complext perssion example is
# allow role 'user' access /{username} with read and write filter, cannot use ?filter qparam
- roles:
- user
predicate: path-template[value="/{username}"] and equals[%u, "${username}"]
priority: 100
mongo:
readFilter: '{"status": "public"}'
writeFilter: '{"status": "public"}'
protectedProps: ["status", "user"]
overriddenProps: {"status": '"public"', "user": "@user.userid"}
forbiddenQueryParams: [ "filter" ]
something like %USER for the ACLs ?
Currently you can use in aggregation the following vars: Starting from RESTHeart v4.2.0 the following aggregation variables can be used to allow handling paging in the aggregation via default page and pagesize query parameters:
@page the value of the page query parameter
@pagesize the value of the pagesize query parameter
@skip to be used in $skip stage, equals to (page-1)*pagesize
@limit to be used in $limit stage, equals to the value of the pagesize query parameter
In V6 you'll have also @user and @request objects. So you could use for instance @user.property (assuming that 'property' is defined in the user document)
There is no automatic hiding of the password in aggregations like you have in the standard GET request on users collection. The idea is that aggregations are free to be defined by the developer. Just add a project stage to hide it.
has all the features that are interesting for me :)
is there a way to inject javascript code into the aggregation ? something like:
"stages" : [
{ "$match" : { "timestamp" : { "$gte": "(new Date((new Date()).getTime() - (3 * 24 * 60 * 60 * 1000)))" }}},
{ "$group" : { "_id" : "$hashtag", "count" : { "$sum" : 1 } } },
{ "$sort" : { "count" : -1 } },
{ "$limit": { "$var": "@pagesize" } }
],
"type" : "pipeline",
"uri" : "hashtagslastdays"
}
]it seems the javascript code in the " is not executed, but without the " it can not be inserted
as far as I know, for javascript you need to use mapReduce https://restheart.org/docs/aggregations/#map-reduce
proxy_pass_request_headers on;
proxy_pass_request_body on;
proxy_http_version 1.1;
proxy_redirect default;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
i am unsure if its the docker.. i think its more the nginx
X-Forwarded-For: 80.123.167.xx
X-Real-IP: 80.123.167.xx
it seems reastheart are ignoring them
You need a custom interceptor if you want to log the value of the header
X-Forwarded-For
are the custom interceptors only available in the custom services, or are they also available for the property collection (where i can use for example the remoteIp)