Access Controls/Navigation
Area: User Experience
When setting up access controls and navigation for components within my space, I noticed that when I have open a browser for my site, while not logged into my wallet (using as guest), I'm still able to access certain things that I should not be able to as a guest.
The below example is of just the Inscription Blocklet:
Not logged in, navigation-
Not logged in, selection-
Logged in, navigation -
I have access set to "Owner"-
9 replies
When adjusting navigation, the preview/role selection also shows the same thing no matter the role.
Should this drop down be adjusting view per role? Yet also, the access controls seem not to be applying.
Trying to use the inscription blocklet, it forces me to log in of course, so at least thats ok.
Only navigation related (other blocklets can be seen as well, but require login too), but the inscription blocklet does still show the contract/inscription that was made by the owner, whereas the nftmaker blocklet didnt show its contents. nft maker was set to invite only.
z1croUysBVjGHD7KtHqZyhxKrCrSB2Z1Daa Problem confirmed, we will fix this issue as soon as possible
sounds great 😁
z1croUysBVjGHD7KtHqZyhxKrCrSB2Z1Daa I apologize for the inconvenience. After investigation, it appears that the Inscription Blocklet you are using has set
/as publicly accessible. This is set by the application developer in the application itself, so it is not affected by access control settings. Even if access protection is set, the/route remains publicly accessible.If you would like to see the effect of access protection, you can try using Pages Kit.
thank you for the explanation, and makes sense for navigation. I do have the path set to
/ inscription however.
Im mostly concerned that if before someone else logged in, that they could alter something or use it freely under my association with it. It does require a log in to interact with it (tried it as a guest, not logged into a wallet), but if someone were to access mine will the access controls still block use or would it allow someone else to use my inscription blocklet for their separate actions (if i changed it to accessible to all)? 😵💫
It does show the author as "ArcBlock" 😅
Inscription only allows the blocklet owner to operate, we use the DID Wallet of the multi-signature for verification, even if the public blocklet, other people can not be used normally, only to see the inscription you recorded in evm smart-contract.
Inscription is a public repository, the related logic is here: https://github.com/blocklet/inscription/blob/main/blocklets/inscription/api/routes/auth/verify-blocklet-owner.js
Thanks so much for the explanation