Enforcing Access Control Between Linked Ontology Objects

Ask the Community
, , ,
1

Hi all,

We’re working in Foundry Code Repositories and have a scenario with two ontology objects: List and ListItem. Each ListItem is linked to a List via an ID field, and each List has a sharedWith property that determines which users can access it.

Goal:
We want to enforce that only users who are included in a List’s sharedWith property can view its associated ListItems.

What we’ve tried:

  1. TypeScript v2 Function:
    We imported both objects as resources and tried to filter access in code, but we’re concerned about security of this approach since calling the function from our client code requires the object to be a resource (and fetching from it is an option).

  2. Restricted Views:
    We attempted to use restricted views to enforce row-level security, but struggled to make it work due to the connection between ListItem and List (i.e., filtering ListItems based on the sharedWith property of their parent List).

Has anyone successfully implemented this kind of access control, where permissions on a parent object (List) restrict access to linked child objects (ListItem)? Are there best practices or solutions for enforcing this relationship securely in Foundry, especially when using restricted views or TypeScript functions?

Any advice or examples would be greatly appreciated!

Thanks!

2

Why don’t Restricted Views work here?
To me it sounds like a typical use case for Restricted Views.

Restricted Views support array columns, so you can join ListItem with List in the pipeline, then collect the user access into an array for each ListItem primary key, and back your restricted view by it.