About the Permissions Router API

The Permissions Router API is a utility for organizing channel permission logic. The router lets you set up a default permissions handler as well as handlers specific to channels or resources.

Learn more about the Site API and the Realtime APIs.

With the Permissions Router API, you can:

• Add a handler for a specific channel or resource.
• Set a default handler for channels that don't have explicit handlers.
• Check subscriber permissions.

Setting up permissions

To set up permissions:

1. Create a realtime-permissions.js file in a site's backend.
2. Export a realtime_check_permission hook. This hook runs automatically whenever a subscription is attempted.
3. In the hook body, call permissionsRouter.check() to evaluate the subscriber's permissions based on the handlers you've registered.

Permission resolution

Permissions can be set at the channel level or the resource level. They determine whether subscribers can receive messages published to that channel or resource.

Permissions follow a cascading pattern:

• When the specified resource doesn't have a permissions handler, the handler for its parent channel runs.
• When the specified or parent channel doesn't have a permissions handler, the default permissions handler runs.
• When no default handler is set, all subscribers receive the default permissions of { "read": true }.

Before you begin

It's important to note the following points before starting to code:

• You must create a realtime-permissions.js file in a site's backend. Without it, all subscriptions fail in Wix Studio.
• When the realtime_check_permission hook isn't defined, all subscribers receive the default permissions of {"read": true}.
• When previewing a site, read permissions are always true.