Access rules

Rules run in order on each data-API request. The first deny wins. Allows can merge extra Mongo filters (used for “only rows I own” on list).

Bypass: platform JWTs, personal access tokens (kfx_…), and service tokens (kfxs_…) skip the rule engine. Project user JWTs do not.

Empty rules: if project auth is on and an endpoint has no rules, the default is allow, unless the platform is running with STRICT_ACCESS_RULES=true (deny). Hosted Tefily may enforce strict rules — always add rules on user-facing endpoints.

requireAuth only accepts a project-scoped JWT for that project. A platform token does not satisfy requireAuth; it bypasses the engine entirely instead.

Rule types

requireAuth

Rejects unauthenticated project-user requests. Config is empty.

userFieldCompare

Compares a field on the _users document to a static value or a field on the record.

Owner rows (compare the logged-in user’s _id to authorId on the record):

{
  "ruleType": "userFieldCompare",
  "ruleConfig": {
    "userField": "_id",
    "operator": "eq",
    "compareWith": "record",
    "recordField": "authorId"
  }
}

On list, this becomes a Mongo filter so users only receive their rows. On get / update / delete, the existing record is checked.

Role gate (static value):

{
  "ruleType": "userFieldCompare",
  "ruleConfig": {
    "userField": "role",
    "operator": "eq",
    "compareWith": "value",
    "value": "admin"
  }
}

Operators follow the same comparison set as queries (eq, ne, and similar).

fieldInBody

For create/update: the named body field must be present and, with operator in, must be one of values. Skipped for list/get/delete.

{
  "ruleType": "fieldInBody",
  "ruleConfig": {
    "field": "status",
    "operator": "in",
    "values": ["draft", "published"]
  }
}

File rules

Used on upload endpoints. See Files.

Type	Config
fileSizeLimit	{ "maxBytes": 10485760 }
fileMimeType	{ "allow": ["image/jpeg", "image/*"] }
fileExtensionAllow	{ "extensions": [".png", ".jpg"] }

Typical stack

On each user-owned collection, for every method the app calls:

1. requireAuth
2. userFieldCompare on owner id
3. File rules on upload only