Hey. I’m building out a feature where a user owns an event and the event has a landing page. The event has a status of draft or published. The event has a visibility of public or unlisted.
When an event’s status is draft, no one should see anything except the owner user.
When an event’s status is published and public then anyone can see anything
When an event’s status is published and unlisted then only people with a certain link should be able to see it.
Because I can’t set privacy rules for a url parameter, I can’t think of how to use a token in the URL for example to make this work.
If I interpret you correctly, the thing is by definition public even if unlisted. So anything you do then is obfuscation (hiding the link), and not security (stop data from loading).
Are you usually loading them with as a page thing, and you’re considering adding an extra token to unlisted events to obfuscate? I may be missing something, but if you describe the scenario in a bit more detail, it’ll be easier to suggest something.
Yeah, so I realized you’re right for unlisted, it just means not listed. It can be publicly viewable, so not an issue.
However, I do want to also incorporate preview links. Essentially, when an event is in draft mode, it has a preview link that can be shared and viewed publicly but only by those that have the link’s token (in the url param). I’m trying to figure out a way to make this possible.
Hey @parthapatel0723, you can protect with a token in the URL, check that it’s valid on the server, then provide access from there. A few options for access:
access via privacy rules to a thing (most flexible, future proof/less maintenance
returning all or part of the event object via API (more setup, most secure/control)
Gotcha, that’s what I’m heading towards right now. But, I’m stuck on the options for access.
The privacy rules are set so any event with status not ‘published’ cannot be searched or no fields can be viewed. How would I work with privacy rules so it allows someone with the correct token in the url to be able to view fields from the object?
I also tried the ‘returning all or part of the event object via API’, but this would mean returning individual fields right in the return data? Because returning the object blocks the fields on the frontend due to the privacy rules.
Hey @parthapatel0723 , for privacy rules, one approach is to add this thing to a field on the user, so that when they view the ‘unpublished’ link, they can see the information. This can be done for logged out and logged in users (if cookies enabled). Unfortunately this requires a page refresh to apply. This would typically look like:
auth page with token check
add thing to user and redirect
Arrive on page with rules enabled
For the return data from API, you can return whatever you want, it’s not governed by the privacy rules
Okay, that’s what I was aiming to do but unfortunately, I have cookies disabled. I can’t recall why I did that but I’ll need to see if I can enable it again. Essentially, even a user without an account can be added to a thing’s user list right?
Hmm…when I tried return data from API and connected to the API using App Connector, I still had privacy rules governing, maybe I need to re-examine what I did. Thank you @DjackLowCode !!
@parthapatel0723 , that’s correct, the logged out user is created (with cookies enabled)
You might have this set up for compliance reasons, and can simply request the User to accept cookies, if they don’t, they can’t access.
The API will return whatever data the user calling has access to (unless ignore privacy rules is enabled), practically, you would normally call an internal API with an App key, so this shouldn’t be an issue.
In both cases, you probably want to do the token /code step anyway.
Okay, so I just enabled cookies. It was a long time ago when I started on Bubble and didn’t know has an account and is logged in existed . I just tried your advice, but I can’t seem to add the ghost user to the database. I can add a user with an account no problem, but for some reason cannot add a ghost user to the thing’s list of users.
I’m supposed to see the ghost user in the DB right? I don’t see any ghost users in the DB (myself in an incognito window). However, the user is being assigned a UID (I checked by logging current user’s unique id). I’m not sure if this might be because I use ‘email’ as the primary field on users instead of unique id (again a decision very early on), but may be due to this.
Just saw this, but forgetting all that. I just ended up setting up an admin only api workflow like before (I have done this in the past too and it’s worked so I was so confused on why it wasn’t working… and came here for guidance). Turns out it was because of App Connector, which kept revealing an empty result. I used API connector instead with an admin token and boom, worked first try. Thank you though for all your help! One of those bubble gimicks, lol.
. I just tried your advice, but I can’t seem to add the ghost user to the database. I can add a user with an account no problem, but for some reason cannot add a ghost user to the thing’s list of users.