Nulled Cs-cart Soft Solid Statuses - Independent permissions to methods RESTAPI - ss_permission_api v1.1.1.3

Soft Solid Statuses - Independent Permissions to Methods RESTAPI - ss_permission_api


This extension for CS-Cart and Multi-Vendor provides enhanced control over RESTAPI access. It allows store administrators to set detailed access rules for RESTAPI, regulating access not just by user group, but also by administrator, specific API object (e.g., Products, Orders), and API method (e.g., GET, PUT). This helps improve store security by giving more granular control over who can access and modify specific parts of the API.

Steps for Use:

1. Install the Extension:Begin by installing the ss_permission_api add-on in your CS-Cart or Multi-Vendor store.
2. Managing RESTAPI Rules:After installation, the RESTAPI rule management can be accessed from the Customers tab in the Admin panel.
3. Adding New Rules:
   • Click the + button in the upper right corner to add new rules.
   • Each rule controls access to specific parts of the RESTAPI, and multiple rules can be added for different administrators or API objects.
4. Defining Rule Parameters:When adding a rule, define the following parameters:
   • Name: A descriptive name for the rule (informational purpose).
   • Administrator: Select which administrator the rule applies to.
   • Method:Choose the HTTP method to control access to:
     • GET for reading data,
     • POST for modifying data,
     • PUT for adding new data (e.g., new products, orders),
     • DELETE for deleting data.
   • Entity: Select the specific API object to which the rule applies, such as Products or Orders.
   • Access Status: Define whether the rule should block or allow access to the specified API object for the selected method.
5. Overriding Default RESTAPI Rules:This add-on overrides the standard RESTAPI rules configured in user group settings. By default, administrators may not have access to certain objects, such as Products, but they may have full access to others, like Orders. This extension allows you to specify precise rules for each administrator, even overriding user group defaults.
6. Example Scenarios:
   • If an administrator (e.g., [email protected]) is assigned a rule blocking access to the Orders object, they will receive an error when trying to download orders, while still being able to access other data, such as Products, if allowed by the rules.
   • The add-on ensures that administrators can only access the specific API methods (GET, PUT, DELETE, etc.) for the objects they have permissions for, adding an additional layer of security to the API.

Benefits:

• Granular Control: Administrators can set rules for specific API methods, ensuring more security and precise permissions.
• Overrides Default Settings: The add-on enhances the store's security by allowing overrides to default API access rules set by user groups.
• Improved Security: You can block or grant API access for specific administrators, objects, and methods, preventing unauthorized access to sensitive data.

This add-on is a powerful tool to tighten your store's API security by allowing fine-tuned control over who can access and modify specific parts of the store's data via the RESTAPI.



Extension to CS-Cart and Multi-Vendor allows creating access rules to store RESTAPI. In standard, access to RESTAPI is regulated separately for each user group. Added rules allow to block (or give) access only to selected administrator, only for chosen API object (ex. Products, Orders) only with selected API method (ex. GET, PUT).

We start from installing an extension:



Managing RESTAPI rules menu is in tab Customers:


List contains all information about defined rules. New rules can be added with + button in upper right corner:



When adding rules, we have to define those parameters:

- Name: makes rule different from others, serves only informational purpose.



- Administrator: which administrator is affected by the rule.



- Method: GET means reading data, POST modifying it, PUT adding new data (ex. orders or products), and DELETE deleting data.



- Entity: Object, for which rule applies. Full list of objects and their specification is available here.



- Access status: should the rule block access to part of the RESTAPI, or give it.



Add-on overrides standard RESTAPI rules, which are defined in usergroup settings. Here, administrators by default cannot access products and have full access to orders.



Because we created rule that blocks Orders object for administrator [email protected], trying to download orders gives him a notification:



Administrator can download information about products, even though they are blocked in user group - because we created record that gives administrator access to Products object.



Add-on amplifies store security, letting you set precise RESTAPI access range for each administrator.