Rule Configs
Syntax
Rule configs are stored as a ".write" property on a path in the database using SET_RULE operation.
Its value is an javascript eval string that will be evaluated true or false to determine users' permission on the path whenever a transaction with value write operations on the path is submitted.
Path Variables and Built-in Variables
The path can have path variables like "/transfer/$from/$to/value" to allow flexibility of rule expressions. In the same context, built-in variables are also provided by the system:
Variable / Function | Members | Semantic | Example | API Version |
auth | addr | Sender (signer) address | auth.addr === '$uid' | 1.0 |
auth | fid | Caller (function) ID | auth.fid === '_transfer' | 1.0 |
getValue(<db path>) | To get the value at the db path | getValue('/accounts/' + $user_addr + '/balance') >= 0 | 1.0 | |
getRule(<db path>) | To get the rule at the db path | getRule('/apps/test_app') | 1.0 | |
getOwner(<db path>) | To get the owner at the db path | getOwner('/apps/test_app') | 1.0 | |
getFunction(<db path>) | To get the function at the db path | getFunction('/apps/test_app') | 1.0 | |
evalRule(<db path>, <value>, <auth>, <timestamp>) | To eval the rule config at the rule path | evalRule('/apps/test_app/posts/1', 'hello world', auth, currentTime) | 1.0 | |
evalOwner(<db path>, <permission>, <auth>) | To eval the owner config at the owner path | evalOwner('/apps/test_app/posts/1', 'write_owner', auth) | 1.0 | |
newData | The new data to be set at the given path | getValue('/accounts/' + $user_addr + '/balance') >= newData | 1.0 | |
data | The existing data at the given path | data !== null | 1.0 | |
currentTime | Current timestamp | currentTime <= $time + 24 * 60 * 60 | 1.0 | |
lastBlockNumber | Last block number | lastBlockNumber > 10000 | 1.0 | |
util | A collection of various utilities Check this link :https://github.com/ainblockchain/ain-blockchain/blob/master/db/rule-util.js | util.isString(newData) |
Examples
Rule configs can be set as the following examples:
There is no ‘read’ permission in data access. It means all network participants can read your data. To secure data on specific node path, users need to encrypt the data with their own private key.
Application of Rule Configs
Permission of a value write operation (e.g. SET_VALUE) is check as follows:
When there are no rule configs on the requested path, closest ancestor's rule config is applied
If there are more than one path matched, the most specific rule config is applied
e.g. Among a) /apps/$app_id/$service, b) /apps/afan/$service, c) /apps/afan/wonny, c) is applied.
When the value of the write operation in request is an object, the operation is granted when the permission check succeeds on every path of object. For example, SET_VALUE operation is requested on /foo/bar with value { abc: "abc_val", def: "def_val" }, it should pass the permission check on /foo/bar, /foo/bar/abc, and /foo/bar/def.
Rule config always overrides its ancestors' rule configs
Last updated