When publishing Shopify or Bigcommerce Apps, I had to specify the read/write permissions I wanted for my app (eg. read products, read/write orders...). I am now developing a Magento Extension and wondering where and how I would specify my desired permissions. I took a look in the Connect Marketplace and when downloading extensions, there doesn't seem to be a step, where you agree to any permissions. Am I missing something?
1 Answer
There are not permissions at "extension" level in magento, regardless the installation source (connect, manual, etc).
You could set some ACL at backend level for menus and actions (view/save/edit)
And you can set some permissions for the SOAP an REST APIs throw configuration files.
I don't know exactly how Shopify works but based on my experience with this kind of SAAS product the permissions you set in your extension are very close to a manifest related to API features.
answered Jan 26, 2016 at 8:01
-
so, theoretically, some harmful script (delete all products every 15 minutes), could be included in my code? Is there no other safety layer?– Kevin WuJan 26, 2016 at 13:56
-
... Or delete all products and send all customer data to al qaeda. It's PHP all your actions are visible, in 6 year working with magento i never seen such actions in an extension. Jan 26, 2016 at 15:09
-
-
@Kevin Wu Me too! I'm just enforcing your concept you could do everything! Without any problem. In the new magento2 marketplace all extensions will be tested and manual reviewed, at least is what mage team says. Jan 26, 2016 at 15:19
-