search

Prasad108 / TutesMessanger

Tutes Messanger, Develpment to Serve Others
http://softus.in
8 stars 3 forks source link

One Institute Cannot access the data of other institutes data. #63

Open Prasad108 opened 6 years ago

Prasad108 commented 6 years ago

One institute should not be able to see /edit / delete / create any kind of data of other institutes.

Prasad108 commented 6 years ago

Hi @RahulSawale , u can have look at this issue and resolve it, as it do not require any front end (angular js)knowledge.

proposed solution

  1. Create method which will check that whether the data user is asking belongs to his own institute and
  2. Does he have permission for that operation .
  3. If he has both things- 'relevant data(ie. of his institute) + permission' then API should proceed with normal flow.
  4. If he do not have permission API should simply return him response that- operation failed due to not enough permissions to access the data.