Hi, I am building a WebRTC P2P app for a university project and have hit a security limitation regarding permissions for anonymous users.
The Architecture: We use Appwrite Realtime for signaling. Both the host and joining clients subscribe to a Room row and its related Connection rows (one-to-many relationship). They update these rows with ICE candidates and SDP offers/answers to establish the connection.
The Problem: Since we support unregistered (anonymous) users, we currently have to enable Connection table-level permissions (create, read, update) for role:all or role:guests.
This creates a security vulnerability: any malicious user can read all connection rows in the table, potentially harvesting ICE credentials or sabotaging other sessions.
The Limitation: We attempted to restrict table-level permissions and rely on Row Security, but we hit a roadblock: Appwrite relationships seem to act only as data links, not as permission inheritance structures. We cannot say "If a user has write access to this Room row, they automatically get write access to its child Connection rows."
My Question: Is there a native way to cascade permissions from a parent Table (Room) to child Tables (Connections) without using a server-side Appwrite Function to manually manage ACLs for every insert? If not, is this feature on the roadmap for the TablesDB API?
Recommended threads
- Attribute not found in schema on REST AP...
I'm querying a appwrite collection via the REST API on appwrite cloud 1.9.5 (no SDK) via a cloudflare worker and keep getting: ``` {"message":"Invalid query: A...
- Not allowed permission to upsert a prese...
```js const presenceID = ID.unique(); setPID(presenceID); const presence = await presences.upsert({ presenceId: presenceID, status: "online"...
- Quota not resetting
hi, im using appwrite's free tier plani hit my read limts last month and the billing cycle said it would reset on june 4th but that is today, the billing cycle ...