Limiting record access using record rules

A basic requirement for every application is the ability to restrict which records are exposed to each user on a certain model.

This is accomplished through the use of record rules. A record rule is a domain filter expression specified on a model that is subsequently applied to each data query performed by the impacted users.

As an example, we will add a record rule to the Hostel model so that users in the Employee group will only have access to the public hostel.

Getting ready

We will continue using the my_hostel module from the previous recipe.

How to do it...

Record rules can be added using a data XML file. To do this, perform the following steps:

1. Ensure that the security/security_rules.xml file is referenced by the manifest data key:

       'data': [
           'security/security_rules.xml',
           ...