Open marktani opened 6 years ago
Comment by wallslide
Friday May 19, 2017 at 04:19 GMT
It looks like all you need to accomplish this already exists. Just use Algolia's Secured API-Kes (as op mentioned). Is there some reason why this feature alone isn't enough, or why it couldn't be implemented with Graphcool's current feature set?
Comment by lucfranken
Friday May 19, 2017 at 08:24 GMT
@wallslide thanks!
Will take a look on it. They advice separate indexes that's why I went for that scenario first.
It seems the generation of those keys might now be available with the functions just released, will have to take a look on that.
Let's say you have an invoicing app. Every user has many invoices. I want them to be searchable by Algolia.
I do NOT want users to be able to search all invoices from all users (security issue of course). So there is NO sharing between users at all.
This is what Algolia recommends:
https://www.algolia.com/doc/faq/searching/how-can-i-restrict-the-results-to-objects-my-user-has-access-to/
It seems Algolia advices to create one index per user in a multi-tenant situation.
The only way I see how this could work is if GraphCool would send the records to a variable index name like invoices_1, invoices_2 etc. where the number is the user id.
Does that make sense?
There is also another option with API keys but as GraphCool handles the connection with Algolia that doesn't seem to be possible. And it seems that this is recommended when you want to share some records but not all. Which is not the case in the example scenario.
Other scenario's could be:
It looks to me like one of the most standard use-cases for search.