Respecting Access Control with Local API Operations - FrogBot Docs

In FrogBot, Local API operations enforce access control by default, as REST and GraphQL do. A call without overrideAccess runs the collection’s access rules for the user (or req.user) it’s given, or for an anonymous user when it has none.

Skipping Access Control

Trusted server work, such as scripts, seeds, jobs and system hooks, can skip access control with overrideAccess: true.

For example:

// A seed script: no user, so skip access control
const test = await frogbot.create({
  collection: 'users',
  data: {
    email: 'test@test.com',
    password: 'test',
  },
  overrideAccess: true,
})

Respecting Access Control

Local API calls run access control unless overrideAccess: true is passed. To act for a signed-in user, pass the user (or a req that carries it) with overrideAccess: false; to skip access for trusted server work, pass overrideAccess: true. Pass it explicitly either way, so each call says which it is.

overrideAccess: false: access control runs with the current user’s permissions. This is the default, but say it explicitly.
user: the user access is checked against. Without one, the call runs as an anonymous user.

const authedCreate = await frogbot.create({
  collection: 'users',
  overrideAccess: false, // This ensures access control will be applied
  user, // Pass the authenticated user to check permissions
  data: {
    email: 'test@test.com',
    password: 'test',
  },
})

This example will only allow the document to be created if the user we passed has the appropriate access control permissions.