ACL granularity

Question

I'm trying to implement ACL for my nodejs App. Say i have the following endpoints:

/api/user
/api/picture 

Pictures belong to users.

ACL is able to allow/deny access based on userId to an endpoint. If a request comes to /api/user it is easy for the ACL to know if a certain userId can access it's own data or not: if i'm userId=23 and i do a GET on /api/user/23 there is a direct relation between the resource being requested and the data given to use for checking.

Now, if a request comes to /api/picture with a pictureId, the ACL is not aware of the relation between users and pictures, say /api/picture/60; the ACL does not know if pictureId=60 belongs to userId=23 (used in the example above).

Do you know if there is any ACL solution for nodejs which support this kind of access control? How granular is ACL expected to be?

Answer 1

Document-level ACL granularity is always tricky as your dataset will grow some performance issue may emerge. I personally prefer to store those type of documents using a GraphDB like Neo4J as IMHO it is way more reliable than a relational database when managing this type of ACL its query performances.

Answer 2

There is one solution but it requires a lot of work.

In database on Picture table you can create ACL column that will contains data of who have access to this item. And then when this happens:

request comes to /api/picture with a pictureId

i assume you know userId of currently logged in user?

If yes, you can do following. Get Picture from database with pictureId, and compare userId from column ACL with currently logged in user. If userId from currently logged in user is in column ACL then this user can read/get this Picture.

If you want you can add more functionality by adding actions which user can have on Picture (Create, Read, Update, Delete).