0

I want to write an EOS smart contract to manage users data. I need that only some admin account will able to add, update and delete users and the particular user can only update data. Can I check specific account authorization in a smart contract? And for update, can I check authorization of account either it should be admin or user? I am planning to set the primary key as each user account name. In this,

void insert(name user, std::string first_name, std::string last_name, std::string street, std::string city, std::string state) {
  require_auth( user );
}

It is checking authorization of a particular user, but I need it for an admin account who is going to do all transactions. Any suggestions will be appreciated.

1

You can search for an iterator with given key from multi_index first.

  • iterator found: already created item, require_auth(user)
  • iterator not found: not created item, require_auth(admin)

Permission check can be done in any step of your method. (Even you call require_auth() at the last time of your method, its failure reverts all changes made during that transaction)

--

You can separate insert/update or make them into one method like upsert.

void insert(name user, std::string first_name, ...) {
  require_auth("varshadmin"_n); // specific admin account name
  ...
}

void update(name user, ...) {
  check(has_auth(user) || has_auth("varshadmin"_n), "missing required authorization");
  ...
}

void upsert(name user, ...) {
  addressbook addr(_self, _self.value);
  auto itr = addr.find(user);
  if (itr == addr.end()) {
    // case 1: create new item
    require_auth("varshadmin"_n);
    addr.emplace(...);
  } else {
    // case 2: update existing utem
    check(has_auth(user) || has_auth("varshadmin"_n), "missing required authorization");
    addr.modify(itr, ...);
  }
}
| improve this answer | |
  • require_auth(admin) : Can I pass directly the name of admin account in smart contract code like require_auth(member) whereas member is an account name. – Varsh May 20 at 3:25
  • Means checking the specific account authorization. – Varsh May 20 at 3:29
  • Why not? I added an example to original answer. – conr2d May 20 at 7:05
  • Hey thanx a lot for the answer. – Varsh May 20 at 7:46
  • Does it compulsory to pass "user" i.e user account name while inserting or updating his/her data? Especially if we need to check users authorization. – Varsh May 21 at 3:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.