Question

looking for some help or a blog post really regarding using the auth bundle with RavenDB..

using the HelloWorld example: http://ravendb.net/tutorials/hello-world
i’m trying to disable the user from querying for orders.. i’ve tried different auth roles approaches but i can’t get the damn thing to work.

at present i’ve:
* created a authorization user
* created a authorization role

Id: Authorization/Roles/Orders
    {
      "Permissions": [
        {
          "Operation": "order/1",
          "Tags": [
            "Orders"
          ],
          "Allow": false,
          "Priority": 1
        }
      ]
    }

ID: Authorization/Users/ayende
{
  "Name": "Ayende Rahien",
  "Roles": [
    "Authorization/Roles/Orders"
  ]
}

just can’t get my head around how to filter out the orders from queries.
for example, querying orders/1 will return an order of 1 prior to applying the permission.

after using:

session.SecureFor("Authorization/Users/ayende", "orders/1");

I would expect orders to return no orders..

do i have this concept totally wrong or just configured my permission’s wrong?

thanks

Answer 1

Have you applied your permission to the document then invoked SaveChanges? Maybe if you post your code it would easier to tell what’s happening.