Role Assignment, Management, and Permissions at Parse (Parse.com)

Question

Roles in Parse use ACLs for permissions.

To add a role to a user in the registry, I understand that the role must be readable and writable. My concern is that public access to it means that any user can remove users from this role.

This is true, and if so, how can I get around this? Some reliable examples of role assignment and management will be very helpful.

Answer 1

This was answered on the Parse website for those who are looking for a solution:

The role should not be publicly available. If you want to automatically assign a role to users during registration, you can add afterSave in the cloud code, which uses a master key to change the role.

afterSave: https://www.parse.com/docs/cloud_code_guide#save

useMasterKey: https://parse.com/docs/cloud_code/symbols/Parse.Cloud.html#.useMasterKey

https://www.parse.com/questions/role-assignment-management-and-permissions#answer-the-role-does-not-need-to-be-public-writable-if-you