Permission management on individual contributions

[morzan1001]

Hey, I'm playing around with appwrite to see if it's for me and I want to use it in backends in the future. However, I've run into a problem that you might be able to help me with.

In a normal blog application, a user should be able to create, delete and edit posts. Other users should be able to see these posts but not edit or delete them. I have created a collection in which the posts can be stored, but now I have to give the users all the permissions for delete and update although each user should only be able to edit his own post. How do I implement this with the appwrite permissions? Does anyone have a suggestion for me? Thank you very much

[Saakhavat-Prime]

Appwrite handles this using document-level permissions, so you don't need to give every user global update or delete access to the collection.

A common approach for a blog application is:

• Allow authenticated users to create documents in the collection.

• When a user creates a post, set the document permissions like this:

  • Read: Everyone (Role.any()) or authenticated users (Role.users()), depending on your requirements.
  • Update: Only the creator (Role.user(user.$id)).
  • Delete: Only the creator (Role.user(user.$id)).

Example:

await databases.createDocument(
  DATABASE_ID,
  COLLECTION_ID,
  ID.unique(),
  {
    title: "My First Post",
    content: "Hello World!",
    authorId: user.$id
  },
  [
    Permission.read(Role.any()),
    Permission.update(Role.user(user.$id)),
    Permission.delete(Role.user(user.$id))
  ]
);

This way:

• ✅ Any user can read posts (if Role.any() is used).
• ✅ Users can edit and delete only their own posts.
• ❌ Users cannot modify posts created by other users.

It's also a good idea to store the authorId in the document. This makes it easy to query a user's posts or display the author's information. However, authorId alone does not provide security—the document permissions are what actually enforce who can update or delete the post.