Security of Users table

Anvil Q&A
7

Ok, I went overboard. Created dependency app that provides either a clear text version of the row.get_id() or an encrypted version. My thought for the secure versions was for some of my Stripe integrations where I want to send a reference id out that I can then use to reconcile accounts.

The other use is to provide links back and forth between tables that can’t be associated “over the shoulder”.

Gives two modules, common and secure, that have mirrored functions.

Get a identifier for the authenticated user:

>>> common.get_user_id()
'911779_2238396130'

>>> secure.get_user_id()
'YooTuJr%2Bm6SLWMwQwpez5Jb1exIl7OyapStY%2Bu6IfjpNHFnu2zKwy6uFXbZW'

There is a generic version for any row:

>>> row = app_tables.common.search()[0]
>>> common.get_row_id(row)
'911818_2238554191'
>>> secure.get_row_id(row)
'5lt45mQmv%2B63WHwlIe8Za%2B1esOs6%2BNeOfr4XEoPN2Uo%2FSdkOXGye1MBr%2BMvK'

Ok, who cares… But here is the interesting bit, from either the common or secure id you can obtain the row without knowledge of what table it is from. This is because we are encoding the row.get_id() which includes the table id already.

>>> row = common.get_row('911818_2238554191')
>>> dict(row)
{'info': 'likes the color red.', 'user': '911779_2238396130'}

>>> row = secure.get_row('5lt45mQmv%2B63WHwlIe8Za%2B1esOs6%2BNeOfr4XEoPN2Uo%2FSdkOXGye1MBr%2BMvK')
>>> dict(row)
{'info': 'likes the color red.', 'user': '911779_2238396130'}

This implementation only works with accelerated tables. This is due to the changes in how tables can be accessed as well as where the table id is stored. I also have not tested the edge cases here with table views and such.

Here is the clone if you are so inclined:
clone

Review the tests to see usages.

3 Likes