Record-level security: advanced filters and non-GET requests

There are several examples of this in the blog and forum, but it won’t work unless you create and populate your owner_id column. I can’t think of a way that DreamFactory would know to populate this field automatically.

This post by @benbusse is a great overview with links to other resources on the topic: How to implement data access based on a table with user’s permissions. Another post by Ben gives an example in AngularJS: How would I manage (in the DSP), every user has his/her own Todo-List?. There, he says,

In Ben’s AngularJS example, the app adds the logged-in user’s {user.id} to the POST, PUT, and DELETE calls so they can be filtered on by the server-side filter he has in place.