Jump to content

  • You cannot start a new topic
  • You cannot reply to this topic

Addon [Soft-Solid] - Independent Permissions To Methods Restapi Rate Topic   - - - - -

 
  • soft-solid
  • Junior Member
  • Members
  • Join Date: 19-Apr 10
  • 887 posts

Posted 29 July 2019 - 02:13 PM #1

Hello,

we present you a new extension to CS-Cart and Multi-Vendor allows creating access rules to store RESTAPI. In standard, access to RESTAPI is regulated separately for each user group. Added rules allow to block (or give) access only to selected administrator, only for chosen API object (ex. Products, Orders) only with selected API method (ex. GET, PUT).

 

We start from installing an extension:

 

ss_permission_api_1_en.png?1564403955988

 

Managing RESTAPI rules menu is in tab Customers:

 

ss_permission_api_2_en.png?1564403955988

 

List contains all information about defined rules. New rules can be added with + button in upper right corner:

 

ss_permission_api_3_en.png?1564403955988

 

When adding rules, we have to define those parameters:

- Name: makes rule different from others, serves only informational purpose.

 

ss_permission_api_4_en.png?1564403955988

 

- Administrator: which administrator is affected by the rule.

 

ss_permission_api_4a_en.png?156440648008

 

- Method: GET means reading data, POST modifying it, PUT adding new data (ex. orders or products), and DELETE deleting data.

 

ss_permission_api_4b_en.png?156440648008

 

- Entity: Object, for which rule applies. Full list of objects and their specification is available here.

 

ss_permission_api_4c_en.png?156440648008

 

- Access status: should the rule block access to part of the RESTAPI, or give it.

 

ss_permission_api_4d_en.png?156440648008

 

Add-on overrides standard RESTAPI rules, which are defined in usergroup settings. Here, administrators by default cannot access products and have full access to orders.

 

ss_permission_api_5_en.png?1564403955988

 

Because we created rule that blocks Orders object for administrator test@test.pl, trying to download orders gives him a notification:

 

ss_permission_api_6x.png?1564406524779

 

Administrator can download information about products, even though they are blocked in user group - because we created record that gives administrator access to Products object.

 

ss_permission_api_7.png?1564403955988

 

Add-on amplifies store security, letting you set precise RESTAPI access range for each administrator.

 

Features:

  • core file changes (adding the two hooks described in the README file)
  • Compatibility CS-Cart version 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x, 4.5.x, 4.6.x, 4.7.x, 4.8.x, 4.9.x, 4.10.x
  • Compatibility Multi-Vendor version 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x, 4.5.x, 4.6.x, 4.7.x, 4.8.x, 4.9.x, 4.10.x


Please, do not hesitate contact us if you have any additional questions.

 

Link to addon

 

See our other addons in Marketplace.

 


Team of SoftSolid
cs-cart.pl