Skip to main content
Access Control determines what a user can and cannot do with any given Document, as well as what they can and cannot see within the Admin Panel. By implementing Access Control, you can define granular restrictions based on the user, their roles (RBAC), Document data, or any other criteria your application requires. Access Control functions are scoped to the operation, meaning you can have different rules for create, read, update, delete, etc. Access Control functions are executed before any changes are made and before any operations are completed. This allows you to determine if the user has the necessary permissions before fulfilling the request. There are many use cases for Access Control, including:
  • Allowing anyone read access to all posts
  • Only allowing public access to posts where a status field is equal to published
  • Giving only users with a role field equal to admin the ability to delete posts
  • Allowing anyone to submit contact forms, but only logged in users to read, update or delete them
  • Restricting a user to only be able to see their own orders, but no-one else’s
  • Allowing users that belong to a certain organization to access only that organization’s resources
There are three main types of Access Control in FrogBot:

​
Default Access Control

FrogBot provides default Access Control so that your data is secured behind Authentication without additional configuration. To do this, FrogBot sets a default function that checks that a user is present on the request and that the user belongs to the collection used to access the Admin Panel (config.admin.user). You can override this default behavior by defining your own Access Control functions as needed. This means that adding a second Authentication-enabled collection does not automatically grant its users access to everything. Users from collections other than config.admin.user are denied by default unless you provide your own Access Control functions. Here is the default Access Control that FrogBot provides:
In the Local API, all Access Control is skipped by default. This allows your server to have full control over your application. To opt back in, you can set the overrideAccess option to false in your requests.

​
The Access Operation

The Admin Panel responds dynamically to your changes to Access Control. For example, if you restrict editing ExampleCollection to only users that feature an “admin” role, FrogBot will hide that Collection from the Admin Panel entirely. This is super powerful and allows you to control who can do what within your Admin Panel using the same functions that secure your APIs. To accomplish this, FrogBot exposes the Access Operation. Upon login, FrogBot executes each Access Control function across all Collections and Fields and returns a response that reflects what the authenticated user can do within your application.
When your access control functions are executed via the Access Operation, the id, data, siblingData, blockData and doc arguments will be undefined. Additionally, Where queries returned from access control functions will not be run - we’ll assume the user does not have access instead.This is because FrogBot is executing your functions without referencing a specific Document.
If you use id, data, siblingData, blockData and doc within your access control functions, make sure to check that they are defined first. If they are not, then you can assume that your Access Control is being executed via the Access Operation to determine solely what the user can do within the Admin Panel.

​
Locale Specific Access Control

To implement locale-specific access control, you can use the req.locale argument in your access control functions. This argument allows you to evaluate the current locale of the request and determine access permissions accordingly. Here is an example: