meteor-partitioner icon indicating copy to clipboard operation
meteor-partitioner copied to clipboard

Remove findHook shortcut on select by _id

Open jamiecollinson opened this issue 10 years ago • 2 comments

This (as commented) allowed finds across groups if the _id was known. I'm not sure on the use case for this, but in applications which rely on tenants being completely unable to see each other this was a fairly large hole in securely partitioning them.

jamiecollinson avatar Jun 29 '15 10:06 jamiecollinson

I discussed this further in https://github.com/mizzao/meteor-partitioner/issues/9#issuecomment-117949495.

I'm not sure if this will ever serve as a good multi-tenant package, but we should have that discussion.

As you have implemented, this wouldn't work - the string would need to be rewritten as an object with the _groupId. (see linked comment)

mizzao avatar Jul 02 '15 08:07 mizzao

I hadn't realised about the search by id as string - by convention we're always using object pattern.

Aside from the fact I'm working on an app which requires it, I think a good solution to the multi-tenancy problem would be very compelling. I'm not aware of anything else out there other than your package, and given Meteor's positioning and suitability for prototyping SaaS products it would be a real benefit to the community.

I'm clearly not as experienced with Meteor as you, but I'd be more than happy to help out.

jamiecollinson avatar Jul 02 '15 13:07 jamiecollinson