How to customize the OData server using JayData?

Question

I'm quite new to JayData, so this may sound like a stupid question. I've read the OData server tutorial here: http://jaydata.org/blog/install-your-own-odata-server-with-nodejs-and-mongodb - it is very impressive that one can set up an OData provider just like that. However the tutorial did not go into details about how to customize the provider.

I'd be interested in seeing how I can set it up with a custom database and how I can add a layer of authentication/authorization to the OData server. What I mean is, not every user may have permissions to every entity and not every user has the permission to add new entities.

How would I handle such use cases with JayData?

Answer 1

UPDATE:

Here are two posts that will get you started:

• How to use the odata-server npm module
• How to set up authentication/authorization

The $data.createODataServer method frequently used in the posts is a convenience method that hides the connect/express pipleline from you. To interact with the pipeline examine the method body of $data.createODataServer function found in node_modules/odata-server folder.

---

Disregard text below

Authentication must be solved with the connect pipeline there are planty of middleware for that.

For authorization EntityContext constructor accepts an authorization function that must be promise aware.

The all-allow authorizator looks like this.

  function checkPerm(access, user, entitysets, callback) {
        var pHandler = new $data.PromiseHandler();
        var clbWrapper = pHandler.createCallback(callback);
        var pHandlerResult = pHandler.getPromise();
        clbWrapper.success(true); // this grants a joker rw permission to everyone
        //consult user, entitySet and acces to decide on success/error
        //since you return a promise you can call async stuff (will not be fast though)
        return pHandlerResult;
    }

I have to consult with one of the team members on the syntax that let you pass this into the build up process - but I can confirm this is doable and is supported. I'll get back with the answer ASAP.

Having authenticated the user you can also use EntityContext Level Events to intercept Read/Update/Create/Delete operations.

$data.EntityContext.extend({
   MySet: { type: $data.EntitySet, elementType: Foobar,
            beforeDelete: function(items) {
               //if delete was in batch you'll get multiple items
               //check items here,access this.request.user 
               return false // deny access
            }

});

And there is a declarative way, you can annotate Role names with permissions on entity sets, this requirest that your user object actually has a roles field with an array of role names.

Answer 2

I too have been researching oData recently and as we develop our platform in both node and C# naturally looked at JayStorm. From my understanding of the technical details of JayStorm the whole capability of Connect and Express are available to make this topic possible. We use Restify to provide the private API of our platform and there we have written numerous middleware modules for exactly this case.

Answer 3

We are using JayData for our OData Service layer also, and i have implemnment a very simple basic authentication with it. Since the JayData is using Express, so we can leverage Express' features. For Basic Auth, the simplest way is:

app.use(c.session({ secret: 'session key' }));
// Authenticator
app.use(c.basicAuth('admin', 'admin'));
app.use("/odata.svc", $data.JayService.OData.Utils.simpleBodyReader());

you also can refer to this article for more detail for authentication with Express: http://blog.modulus.io/nodejs-and-express-basic-authentication

Thanks.

Answer 4

I wrote that blogpost, I work for JayData. What do you mean by custom database? We have written a middleware for authentication and authorization but it is not open source. We might release it later. We have a service called JayStorm, it has a free version, maybe that is good for you. We probably will release an appliance version of it.