File permission overview

Rule syntax

A set of permission rules consists of multiple rules. Each rule contains the following information:

• Scope: Defines the scope in which the rule applies.

  In the security rules for file storage, the scope of each rule is a file path. You can specify a particular file by its path. You can also use a JavaScript regular expression to refer to a group of files or an asterisk (*) to refer to all files. The following examples show three ways to define a scope:

  • File path: xxx/yyy/zzz.jpg. The scope is this specific file.

  • Regular expression: /.*\\.png/. The scope is all files with the .png extension.

  • All collections: The * wildcard represents all collections.

• Operation: Defines a specific operation within the specified scope. All users have read permission for files.

  File storage operations are defined by the following rules:

  • .write: Write operation

  • *: All operations

• Policy: Determines whether a specific operation within the scope is allowed. By default, any operation not explicitly marked as allowed is denied.

  A policy is a statement that indicates whether an operation is allowed. It can be a Boolean value or an expression. If policies conflict, the policy of the first matching rule takes precedence.

  Common expression objects

  Top-level object	Field name	Description
  request.auth	userId	The ID of the user making the request.
  resource.auth	userId	The ID of the user who owns the resource.

  The userId refers to the userId field retrieved from mpserverless.user.getInfo().

  Expression operators

  Operator	Description	Matching type
  ==	Equals	string number
  !=	Not equals	string number
  >	Greater than	number
  >=	Greater than or equal to	number
  <	Less than	number
  <=	Less than or equal to	number
  !	Not	string number

Default rule

For a newly created service, EMAS Serverless automatically provides a default rule. The default rule specifies that only the resource owner can write to any file, and all users can read from any file.

{
  "file": {
    "*": {
      ".write": "request.auth.userId == resource.auth.userId"
    }
  }
}

Rule examples

For example, you can create the following security rules to meet different image access requirements:

• For images in .png format, only the image owner can write, while all users can read.

• For an image at a specific path, only the owner can read and write.

• For all other files, everyone can read and write.

{
    "file": {
        "/.*\\.png/": {
            ".write": "request.auth.userId == resource.auth.userId", 
            "*": true
        }, 
        "xxx/yyy/zzz.jpg": {
            "*": "request.auth.userId == resource.auth.userId"
        }, 
        "*": {
            "*": true
        }
    }
}

Where:

• The first rule applies to .png image files. The regular expression /.*\\.png/ defines the scope of the rule to include all .png images. .read specifies the read operation, and * specifies all other operations. According to this rule, only the resource owner can write to .png image files, while all users can read them.

• The second rule applies to the image at the specific path xxx/yyy/zzz.jpg. Only the resource owner can read and write the file.

• The third rule applies to all files except those matched by the first two rules. All users can read and write these files.

Modify file permissions

For more information, see Set file permissions.