The content in this section only applies when Atlas Device Sync is not enabled. For information about configuring permissions when using Sync, see Sync Permissions Overview.
In traditional applications, an application server exposes an API to client applications and handles database queries on their behalf. To prevent malicious, improper, or incorrect read and write operations, clients don't query the database directly.
Atlas App Services provides a configurable and dynamic rules engine that enables you to run a MongoDB query from client applications while transparently preventing unauthorized reads and writes. Rules are defined for entire collections in a linked MongoDB Atlas cluster and apply to individual documents in the collection dynamically based on the application user that issued a query. You can also define default rules that serve as a fallback for any collection that doesn't have its own rules.
Federated data sources do not support rules or schemas. You can only access a Federated data source from a system function.
The rules engine handles incoming queries with the following 4-step process:
App Services evaluates the queried collection's Filters in the context of the incoming request. Filters dynamically add additional query predicates and projections to incoming queries based on an expression that you define.
After evaluating, App Services applies all relevant filters to the incoming query and then finds all documents that match the filtered query.
App Services evaluates a Role with specific read and write permissions for each document that matches the filtered query. You define the roles for each collection, including the permissions they have and the conditions under which they apply.
To learn more about roles, explore the roles reference page. There you'll find more information, including configuration parameters, use-case examples, and details on how App Services assigns roles to documents.
Once App Services has evaluated a role for each document, it runs the filtered query and prevents reads and writes on each document unless the document's role allows them. If no role applies to a specific document, App Services withholds that document entirely and prevents the query from reading or writing any fields.
If the query was a write operation, App Services checks each affected document to ensure that they conform to the collection's Document Schema. If any document does not match the schema, App Services rolls back the operation and rejects the query.
You can define a set of default roles and filters that apply to any collection in a data source that does not have more specific collection rules defined.
To learn more about default roles and filters, including how to define them, see Role-based Permissions.