Disallow resource to be created or edited in refine
I have an api that publicly allows a resource entry to be created (for example a comment) . However I don't want my site admins (or anyone who has access to the refine admin panel for that matter) to be able to create or edit these entries.
5 Replies
Hi @blackbearftw. I'm kapa.ai, your friendly support bot. I will try to answer your question by searching through the knowledge base. :wave:
----------------------
In Refine, you can control access to resources using the
accessControlProvider
prop in the <Refine />
component. This prop accepts an object with a can
method that determines whether a certain action on a resource is allowed or not.
To disallow creation or editing of a resource, you can return false
from the can
method for the create
and edit
actions on that resource. Here's an example:
In this example, the can
method checks if the resource is comments
and the action is either create
or edit
. If both conditions are true, it returns { can: false, reason: "Unauthorized" }
, which disallows the action. For all other resources and actions, it returns { can: true }
, which allows the action.
This will effectively prevent anyone who has access to the Refine admin panel from creating or editing comments.
For more information, you can refer to the Refine documentation on Access Control (https://refine.dev/docs/guides-and-concepts/access-control/).
Please note that this only controls access on the frontend. You should also implement appropriate access control on your backend to ensure that unauthorized actions cannot be performed even if someone bypasses the frontend controls.
----------------------
Note: you can ask me a follow up question by @ mentioning me again :speech_balloon:
----------------------<@490961337896402944> kapa.ai is still learning and improving, please let us know how it did by reacting below
xenial-black•9mo ago
Is there any other way that is part of the meta? @kapa.ai
Let me check the knowledge base for you. One moment! :books:
----------------------
Yes, Refine also allows you to use Attribute Based Access Control (ABAC) by accessing the
resource
object you passed to the <Refine />
component. This can be useful if you want to grant permissions based on the value of a field in the resource object.
Here's an example:
In this example, the can
function receives the resource
object you pass to the <Refine />
component. If the resource name is "comments" and a certain meta field (yourUsefulMeta
in this case) is true
, and the action is either "edit" or "create", it returns { can: false, reason: "Unauthorized" }
, which disallows the action.
For more information, you can refer to the Refine documentation on Meta Access (https://refine.dev/docs/core/providers/access-control-provider#meta-access).
----------------------
Note: you can ask me a follow up question by @ mentioning me again :speech_balloon:
----------------------<@490961337896402944> kapa.ai is still learning and improving, please let us know how it did by reacting below