CMS: Collection Permissions Overview

5 min read
Before you begin:
You may want to read about your collection fields before reading this article. For a more specific guide, you can read changing your collection permissions..
Permissions give you control over which visitors are allowed to access and interact with the data in your collections, and what they are allowed to do.

For example, your site may have a feedback section where visitors can post comments that you store in a collection. You may want to allow all visitors to add new comments, all visitors to read comments, and only the admin to update or delete existing comments.

Permissions are defined per collection. You assign permissions that determine which user roles can perform which actions. For example, you might grant Create permissions to Site members for your 'comments' collection, but allow only Admins to Create items in your 'products' collection.
Velo by Wix users:
The Wix Data API lets you access your collections directly using code, giving you more capabilities than what is available in the Editor. Learn more

In this article, learn more about:


Important information about accessing collections

When choosing collection permission presets, pay careful attention to the default permissions. 

The collection permissions model contains a number of presets that automatically set the permissions for common scenarios. For instance, the setting Public should only be used for non-sensitive information, such as collections without user data. This is because the read permission of that collection will be set to the Anyone role and all the other actions are restricted to only the Admin role:
  • View - Anyone
  • Add - Admin
  • Update - Admin
  • Delete - Admin
Another example is the Form Submissions preset, which defines the following permissions:
  • View - Admin
  • Add - Anyone
  • Update - Admin
  • Delete - Admin 

When using the Custom setting, make sure that the permissions you assign match the business logic and the confidentiality classification of the data in the collection. For example, collections with details about customers or business leads should be treated differently than collections about products.

It's important to note, that depending on the permissions you apply, information in a collection can be accessed or modified regardless of the site flow. For example, your site may include a submit button for new comments to be inserted to the comments collection. However, if the collection is configured to allow anyone to delete the comments, it would be possible to do this by a direct call to the collection, even without a button on the page.
Important:
Dataset configuration impacts actions that can be taken on the page, but only collection permissions can actually limit operations that can be performed on data by various roles. Learn more

Permissions

The following permissions are supported.
Permission
Description
View
Retrieve and view data
Add
Add new data
Delete
Delete an existing item
Update
Edit an existing item
Note:
Data access permissions do not change with PII encryption. Appropriate permissions must be set to maintain the confidentiality of the data. Read more about PII here.

Roles

Roles are automatically assigned to users based on their activity and status in the site. You can only edit or delete custom roles that you create.
Role
Description
Admin
The owner of the site, collaborators assigned to the Admin (Co-Owner) role, and collaborators with permissions to access CMS data. 
Site member author
The user who created the current item
Site member
A user who is logged into the site
Anyone
A user on the internet who is not logged into the site (may or may not be a visitor)
Custom
A role that you create and tailor to your needs. Learn more
Currently, Custom roles are not supported by the collection permission model. However, Velo users can implement a custom role on a collection by setting the collection permission to ’’admin” and using code to make a data call from the backend with the suppressAuth option. The data call should be made after the membership custom role is validated with the wix-users API functionality in the code.
The Admin always retains permissions for all actions.

The Site member author role is different from the other roles in that it applies to specific items in a collection instead of applying site-wide. The Site member author is a Site member who created a specific item and therefore receives added permissions for that item that wouldn't have been granted otherwise. 

When you preview your site, you do so in the Admin role. To interact as another type of user, first publish your site and then navigate to your live site and either log in as a different user (Site member) or not log in at all (Anyone). Remember that, if Sandbox is enabled on your site, your live site works with the live collections and not with the sandbox collections you see in the CMS or when previewing your site. 
Note:
Some roles depend on your having a Members Area on your site. If you use Velo by Wix, you can also add membership functionality with the wix-members-backed API.

Presets for collection permissions

When setting the permissions for your collection, you can choose from a list of presets. The presets automatically set the permissions for a number of common scenarios, as shown in the table below.
 
Based on the preset you select, each role is assigned permissions that match the needs of the scenario. You can always select Custom Use to customize the permissions granted to a role.
Type
Read
Create
Update
Delete
Public
Anyone
Admin
Admin
Admin
Form Submission
Admin
Anyone
Admin
Admin
Member-Generated
Content
Anyone
Site member
Site member
author
Site member
author
Members-Only-Content
Site member
Admin
Admin
Admin
Members-Only Form Submission
Admin
Site member
Admin
Admin
Private Data
Admin
Admin
Admin
Admin
Custom Use
-
-
-
-

Velo by Wix: Authorization suppression

When interacting with your collections using the Data API, you can choose to bypass the permissions model in certain cases. The optional WixDataOptions argument can be sent to the API function call with the suppressAuth property set to true. This will cause the function to run without checking if the current user has the correct permissions. You can only bypass permissions when making API calls from backend code. Client-side API calls will always run permission checks, regardless of what options are passed.

Examples:
A collection may contain comments as well as the email address of the comment creator. Visitors should be able to view the comments, however only the admin should be able to view the email addresses. In such a case, one must set the read permissions on the comments collection to 'Admin'. The Authorization Suppression will help us enable the visitors to view the comments without granting visitors the permission to 'read' the comments collection.

This can be done by writing a web module in a jsw file in the backend that will call the comments collection with the suppressAuth property set to true and then filter out the response and return only the desired fields (comments) to the client for the visitor to view, without the other fields of the collection, specifically without the emails. 
1import wixData from 'wix-data';
2// ...
3let options = {
4    "suppressAuth": true
5};
6wixData.query("myCollection")
7  .find(options)
8  .then( (results) => {
9    if(results.items.length > 0) {
10      let items = results.items;
11      let firstItem = items[0];
12    } else {
13      // handle case where no matching items found
14    }    
15  } )
16  .catch( (error) => {
17    let errorMsg = error.message;
18    let code = error.code;
19  } );
Another example for the use of suppressAuth, is where you want to allow a custom role (a specific site member or a specific group of site members) access to a collection that is set with admin permissions.

In the second example, the web module must check the identity or the role of the site member before calling for the data. In the first example, the web module must filter out the results before returning the data to the client.
Notes:
  • Permissions impact what data is loaded by a dataset. You can learn more about how they work here.
  • Dataset settings can be used to refine what data operations can be performed by the elements connected to that specific dataset. Data is always accessible to the extent specified by permissions using the Data API.
  • You may want to learn about Setting Permissions for a Database Collection.

Did this help?

|