Advanced authorization per resource about eve HOT 4 CLOSED

Thanks for your contribution. Did you check the latest development changelog? I think most of your ideas are already there in one form or another:

1. Predefined db filters are essentially base queries. Plus, you can have multiple resources (API endpoints) targeting the same database collection
2. You can have have public and private resources, and/or restricted/public methods
3. According to REST principles a REST API is stateless so there's no auth.user.id concept that we can apply here (think no session variables). Each request will have to provide its own Authorization token.
4. Current Auth implementation allows custom authorization logic by means of subclassing (v0.0.4) and, I'm probably going to add standard behavior (check the auth token against a configurable db collection containing username and hashed/salted passwords).

from eve.

838ca5f adds customizable role-based access control, which will allow for implementation of auth.user.id-like scenarios. The idea originated while brainstorming about your proposal so thank you!

from eve.

PS: look at the examples/security folder for some code snippets.

from eve.

Wow thanks for that! Roles is really a good idea and seems better suited for REST (no need add custom logic per view)

from eve.