Skip to content

Commit 9d8a0ac

Browse files
committed
Change wording of authorization docs
1 parent 061e37f commit 9d8a0ac

File tree

1 file changed

+9
-6
lines changed

1 file changed

+9
-6
lines changed

README.md

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ These features are new and were not included in v1.
142142
You can enable the following middleware using the "middlewares" config parameter:
143143

144144
- "cors": Support for CORS requests (enabled by default)
145-
- "authorization": Hide or restrict access to certain tables or columns
145+
- "authorization": Restrict access to certain tables or columns
146146
- "basicAuth": Support for "Basic Authentication"
147147
- "firewall": Limit access to specific IP addresses
148148
- "validation": Return input validation errors for custom rules
@@ -554,23 +554,25 @@ These filters are based on OGC standards and so is the WKT specification in whic
554554

555555
### Authorizing tables and columns
556556

557-
By default all tables are reflected. If you want to hide some tables you may add the 'authorization' middleware and define a 'authorization.tableHandler' function that returns 'false' for hidden tables.
557+
By default all tables are reflected. If you want to restrict access to some tables you may add the 'authorization' middleware
558+
and define a 'authorization.tableHandler' function that returns 'false' for these tables.
558559

559560
'authorization.tableHandler' => function ($method, $path, $databaseName, $tableName) {
560561
return $tableName != 'license_keys';
561562
},
562563

563-
The above example will hide the table 'license_keys' in all API input and output.
564+
The above example will restrict access to the table 'license_keys' in all API calls.
564565

565566
'authorization.columnHandler' => function ($method, $path, $databaseName, $tableName, $columnName) {
566567
return !($tableName == 'users' && $columnName == 'password');
567568
},
568569

569-
The above example will hide the 'password' field from the 'users' table in all API input and output.
570+
The above example will restrict access to the 'password' field from the 'users' table in all API calls.
570571

571572
### Sanitizing input
572573

573-
By default all input is accepted and sent to the database. If you want to strip (certain) HTML tags before storing you may add the 'sanitation' middleware and define a 'sanitation.handler' function that returns the adjusted value.
574+
By default all input is accepted and sent to the database. If you want to strip (certain) HTML tags before storing you may add
575+
the 'sanitation' middleware and define a 'sanitation.handler' function that returns the adjusted value.
574576

575577
'sanitation.handler' => function ($method, $tableName, $column, $value) {
576578
return is_string($value) ? strip_tags($value) : $value;
@@ -580,7 +582,8 @@ The above example will strip all HTML tags from strings in the input.
580582

581583
### Validating input
582584

583-
By default all input is accepted. If you want to validate the input, you may add the 'validation' middleware and define a 'validation.handler' function that returns a boolean indicating whether or not the value is valid.
585+
By default all input is accepted. If you want to validate the input, you may add the 'validation' middleware and define a
586+
'validation.handler' function that returns a boolean indicating whether or not the value is valid.
584587

585588
'validation.handler' => function ($method, $tableName, $column, $value, $context) {
586589
return ($column['name'] == 'post_id' && !is_numeric($value)) ? 'must be numeric' : true;

0 commit comments

Comments
 (0)