You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/docs/(data-access)/definitions/access-policies.mdx
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,9 +12,9 @@ Access Policies control the circumstances under which data can be retrieved or e
12
12
13
13
Access Policies are executed in three places in UserClouds:
14
14
15
-
- Every <glossary>accessor</glossary> (read path) is associated with an access policy that controls access for each target user record and filters the records in the response accordingly.
16
-
- Every <glossary>mutator</glossary> (write path) is associated with an access policy that governs whether the write is allowed.
17
-
- Every <glossary>token</glossary> is associated with an access policy that governs the circumstances in which the token can be exchanged for the original data ("resolved").
15
+
- Every <Glossary>accessor</Glossary> (read path) is associated with an access policy that controls access for each target user record and filters the records in the response accordingly.
16
+
- Every <Glossary>mutator</Glossary> (write path) is associated with an access policy that governs whether the write is allowed.
17
+
- Every <Glossary>token</Glossary> is associated with an access policy that governs the circumstances in which the token can be exchanged for the original data ("resolved").
18
18
19
19
In addition, two special types of access policies are available:
Mutators are configurable APIs that allow a client to write data to the User Store. Mutators (setters) can be thought of as the complement to <<glossary:accessor>>s (getters). Mutators serve two functions:
11
+
Mutators are configurable APIs that allow a client to write data to the User Store. Mutators (setters) can be thought of as the complement to <glossary:accessor>s (getters). Mutators serve two functions:
12
12
13
13
- Storing sensitive user data in the store
14
14
- Storing user <<glossary:consent>>s to data processing <<glossary:purpose>>s alongside that data
Selectors are SQL-like clauses that specify which records an <<glossary:accessor>> or <<glossary:mutator>> should act on. Each accessor/mutator is associated with exactly one selector. The selector is specified at accessor/mutator creation time, either as a free text input in the UI, or as a string through the API.
11
+
Selectors are SQL-like clauses that specify which records an <Glossary>accessor</Glossary> or <Glossary>mutator</Glossary> should act on. Each accessor/mutator is associated with exactly one selector. The selector is specified at accessor/mutator creation time, either as a free text input in the UI, or as a string through the API.
12
12
13
-
A Selector may refer to configured Columns, specified as `{ColumnName}`, where ColumnName is the defined name of the Column. Note that non-<<glossary:system column>>s used in selectors are subject to <<glossary:purpose check>>s: each accessor's response will filter out users who have not consented to the accessor's purpose for all columns being retrieved, and all non-system columns used in the selector.
13
+
A Selector may refer to configured Columns, specified as `{ColumnName}`, where ColumnName is the defined name of the Column. Note that non-<Glossary>system column</Glossary>s used in selectors are subject to <Glossary>purpose check</Glossary>s: each accessor's response will filter out users who have not consented to the accessor's purpose for all columns being retrieved, and all non-system columns used in the selector.
14
14
15
-
A Selector may also specify a collection of variables, each of which is represented by a `?`, allowing the Selector to be parameterized for each individual accessor or mutator invocation. The `SelectorValues` array that is specified when executing an Accessor or Mutator is used to parameterize the associated Selector. Each of the values in <<glossary:SelectorValues>> must be a concrete value (i.e., contain no variables), and the number of values in SelectorValues must exactly match the number of variables in the Selector. The variables in a Selector are replaced sequentially by the values in SelectorValues at invocation time - the first value in SelectorValues replaces the first variable in the Selector, and so on. The type of each value must match the expected type of the value placeholder.
15
+
A Selector may also specify a collection of variables, each of which is represented by a `?`, allowing the Selector to be parameterized for each individual accessor or mutator invocation. The `SelectorValues` array that is specified when executing an Accessor or Mutator is used to parameterize the associated Selector. Each of the values in <Glossary>SelectorValues</Glossary> must be a concrete value (i.e., contain no variables), and the number of values in SelectorValues must exactly match the number of variables in the Selector. The variables in a Selector are replaced sequentially by the values in SelectorValues at invocation time - the first value in SelectorValues replaces the first variable in the Selector, and so on. The type of each value must match the expected type of the value placeholder.
16
16
17
17
Examples of selectors include:
18
18
19
19
-`{FirstName} LIKE ?`
20
-
-`{Address}->>’country’ = ‘USA’`
20
+
-`{Address}-</Glossary>’country’ = ‘USA’`
21
21
-`{BoolColumn} = TRUE OR {IntColumn} = ?`
22
22
23
23
See below for a longer list of examples.
@@ -84,8 +84,8 @@ ARRAY_ELEMENTS must either be a VALUE or a comma-separated list of VALUEs. Each
84
84
85
85
### COLUMN_IDENTIFIERs
86
86
87
-
- {column_name} - The selector query will replace the column identifier with the column value for the specific column_name for a given user
88
-
- {column_name}->>’field_name’ - If column_name refers to a column that has a data type of address or composite, a valid subfield specified by field_name can be referenced in the column identifier.
87
+
-`{column_name}` - The selector query will replace the column identifier with the column value for the specific column_name for a given user
88
+
-`{column_name}` - ’field_name’ - If column_name refers to a column that has a data type of address or composite, a valid subfield specified by field_name can be referenced in the column identifier.
89
89
90
90
### INT_VALUEs
91
91
@@ -198,9 +198,9 @@ The following are all examples of valid selector queries:
198
198
|`{IntColumn} = ANY ARRAY[3, 4::INT, ?]`| return users where the IntColumn value is either 3, 4, or the parameterized value |
199
199
|`ABS(MOD({IntColumn},3)) = ?`| return users where the absolute value of IntColumn value mod 3 equals parameterized value |
200
200
|`DIV({IntColumn}, ?) = ?`| return users where the quotient of dividing the IntColumn value by a parameterized value equals a second parameterized value |
201
-
|`{AddressColumn}->>’country’ IS NULL`| return users where the country field of AddressColumn is not set |
202
-
|`{AddressColumn}->>’country’ = ?`| return users where the country field of AddressColumn equals the parameterized value |
203
-
|`{AddressColumn}->>’country’ = ‘USA’`| return users where the country field AddressColumn is ‘USA’ |
201
+
|`{AddressColumn}-</Glossary>’country’ IS NULL`| return users where the country field of AddressColumn is not set |
202
+
|`{AddressColumn}-</Glossary>’country’ = ?`| return users where the country field of AddressColumn equals the parameterized value |
203
+
|`{AddressColumn}-</Glossary>’country’ = ‘USA’`| return users where the country field AddressColumn is ‘USA’ |
204
204
|`{StringColumn} LIKE ?`| return users that have a StringColumn value that matches the parameterized pattern |
205
205
|`{StringColumn} LIKE ‘%foo%’`| return users that have a StringColumn value that contains the string ‘foo’ |
206
206
|`lower({StringColumn}) = ANY ARRAY[‘foo’,’bar’,’baz’]`| return users that have a StringColumn value that when lower-cased equals either ‘foo’, ‘bar’, or ‘baz’ |
0 commit comments