0

I have 2 classes in Parse, a User class and a Group class. The idea is simple. A logged-in user will be able to create a new Group object, and an array relationship will form between that user and that newly created group. That user can now invite other users to that group via a push notification invitation. A second user will also form a relationship with that group object once he accepts the invite.

So far this is simple and working fine. However, I want the creator of that group object to have full control of the group he created.

1- Creator can invite other users, members cannot.

2- Creator can kick a member out

3- Creator can destroy/delete the group object.

I'm not sure what is the correct way of implementing this using ParseRole. Any suggestions?

Manuel
  • 14,274
  • 6
  • 57
  • 130
Spike Flail
  • 683
  • 3
  • 8
  • 17
  • Add ACL to the group , creator -> RW access type will allow creator to update the group object they are the creator of. ACL section of docs should help .... additionally, you can represent group members ACL in the _ROLE class. when you create a group, also create a ROLE representing THAT group and just incrementally add group users to the ROLE in question and grant READ to the Role they all belong to using Role.name in the ACL grant for a group. – Robert Rowntree Mar 10 '15 at 18:37

2 Answers2

0

You can enforce requirement 1 and requirement 3 with row-level ACL permitting write/delete to the Group table only by the creating user. (to enforce this for invitations, check the group's ACL in the invite logic to see if the inviting user equals the creating user).

Requirement 3 is trickier and, I think, not achievable given how you describe the data. A user who accepts an invitation can add to their own array of groups, but no other user (including a group creator) will be able update that user's row.

Your alternatives are either (a) represent group membership with an array on the group object, or (b) create a another object, one for each user, where the member-of-groups array is kept. Think of this object as a user's persona, and keep a pointer relationship between it and its user.

danh
  • 62,181
  • 10
  • 95
  • 136
0

You can add column 'author' to group class with a User pointer. When you receive a request, you check if the request author equal to author group.

You must add the user token in your request and compare Parse.User.current() with Group author.

Bluety
  • 1,869
  • 14
  • 22