Access control determines which resources an authenticated requester may see or operate on. For collection listings, consistency does not require identical responses: each requester should receive only the resources they can access. section 7.3.4
Apply access control to collection listings with these rules:
- Filter the response to resources available to the requester, so two people listing the same collection may receive different results. section 7.3.4
- When possible, structure resources to avoid mixed-access collections; a secured collection can then return 403 Forbidden. section 7.3.4
- Do not assume every list request can use a single response for every requester when permissions differ by item. section 7.3.4
Chat rooms and messages
A list request for ChatRoom resources targets /chatRooms. A request for messages under one room targets /chatRooms/{id}/messages. If a requester can access only some rooms, the response contains only those rooms rather than exposing the full collection. section 7.3.4
Listing 7.2 An example of the standard list method
abstract class ChatRoomApi {
@get("/chatRooms") #1
ListChatRooms(req: ListChatRoomsRequest): ListChatRoomsResponse;
@get("/{parent=chatRooms/*}/messages") #2
ListMessages(req: ListMessagesRequest): ListMessagesResponse;
}
interface ListChatRoomsRequest {
filter: string;
}
interface ListChatRoomsResponse {
results: ChatRoom[];
}
interface ListMessagesRequest {
parent: string;
filter: string;
}
interface ListMessagesResponse {
results: Message[];
}
Use the API listing to compare top-level ChatRoom listing with nested Message listing, including request filters and result collections. section 7.3.4
