Skip to content

Permissions API

Backendless security mechanism assigns an Access Control List (ACL) to every file in the file storage. An ACL defines users and user roles that have permissions to read, write, or delete a file. The Permissions API allows programmatic control over file ACL by granting or denying permissions to a file for a user or a user role. Using the API permissions can be applies for a user or user role individually or in "bulk" - for all users or user roles in a single call.

The path or the url argument in the APIs below must identify a file or directory for which the permission is modified. The value must be the short version of the path. For example, suppose the full URL of a file in the file storage system is:

https://api.backendless.com/31CB9FED-F34C-5541-FF26-6C2B6719F200/23432-A6B2-FF6B-31CB9FED/files/movies/vacation.mp4

The path to the file in the API call must contain only the directory and the file name (without the leading slash):

movies/vacation.mp4

The user account (or the role) on which behalf the API is executed must contain the Permission permission. For example, if the call is made by an authenticated user, the role for the user account would be AuthenticatedUser. The role must have the Permission permission in order for the API call to go through.

Methods

To set the permissions for a file, use FilePermission class.

// grant permission for the operation to the user for the URL
- (void)grantForUserWithUserId:(NSString * _Nonnull)userId path:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;

// deny permission for the operation for the user for the URL
- (void)denyForUserWithUserId:(NSString * _Nonnull)userId path:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;

// grant permission for the operation to the role for the URL
- (void)grantForRoleWithRole:(NSString * _Nonnull)role path:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;

// deny permission for the operation for the role for the URL
- (void)denyForRoleWithRole:(NSString * _Nonnull)role path:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;

// grant permission for the operation to all existing users in the app for the URL
- (void)grantForAllUsersWithPath:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;

// deny permission for the operation for all existing users in the app for the URL
- (void)denyForAllUsersWithPath:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;

// grant permission for the operation for all existing roles in the app for the URL
- (void)grantForAllRolesWithPath:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;

// deny permission for the operation for all existing roles in the app for the URL
- (void)denyForAllRolesWithPath:(NSString * _Nonnull)path operation:(enum FilePermissionOperation)operation responseHandler:^(void)responseHandler errorHandler:^(Fault * _Nonnull)errorHandler;
// grant permission for the operation to the user for the URL
func grantForUser(userId: String, path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

// deny permission for the operation for the user for the URL
func denyForUser(userId: String, path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

// grant permission for the operation to the role for the URL
func grantForRole(role: String, path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

// deny permission for the operation for the role for the URL
func denyForRole(role: String, path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

// grant permission for the operation to all existing users in the app for the URL
func grantForAllUsers(path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

// deny permission for the operation for all existing users in the app for the URL
func denyForAllUsers(path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

// grant permission for the operation for all existing roles in the app for the URL
func grantForAllRoles(path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

// deny permission for the operation for all existing roles in the app for the URL
func denyForAllRoles(path: String, operation: FilePermissionOperation, responseHandler: (() -> Void)!, errorHandler: ((Fault) -> Void)!)

Example

[Backendless.shared.file.permissions grantForAllRolesWithPath:@"myfiles/myhelloworld-sync.txt" operation:FilePermissionOperationFILE_WRITE responseHandler:^{
    NSLog(@"Permission granted");
} errorHandler:^(Fault *fault) {
    NSLog(@"Error: %@", fault.message);
}];
Backendless.shared.file.permissions.grantForAllRoles(path: "myfiles/myhelloworld-sync.txt", operation: .FILE_WRITE, responseHandler: {
    print("Permission granted")
}, errorHandler: { fault in
    print("Error: \(fault.message ?? "")")
})