is it possible to add a filter to a webapi entity?

[Jerome2]

Hi,

I have a table with a webapi setup on top of it.

I want to know if I can add some filter on the data returned to make sure the users can read specific data from the underlying table?

for example, I grant access to the product table on my power apps portal through the webapi.

but I want to grant access to products in a specific category only, and make sure the user will never access products in other categories (in case of code injection)

so adding a custom filter all the time during any webapi call to my product table will be great.

any idea?

[chleverenz]

@Jerome2 ,

the way, i do this kind of things is to have an additional entitytable which holds in the core a lookup to the product(s). Then i create a global read to that table. The products are then enabled by a parent relation in the tablepermission so that only those products are visible, which are pointed to by the new table.

This sounds clumsy in the first moment but parent relationship is a really powerful tool.

You have to set up a flow or whatever in order to fill the new table, but you are really flexible, because when your conditions for the visible products change, you can simply add/remove them from that table.

If there is a simpler solution i would also be curious to know 🙂

Ah, and as you have enabled the web api you are aware of the fact, that you can limit the columns which are available via the webapi. So, may be limiting also the columns should be done for safteyreasons, too.

Does this help?

Have fun,

  Christian

[Jerome2]

yeah, its the solution I have in mind too.

and I expected to be able to bypass this solution.

because in my real case its just there to exclude few key records in thousands of records.

so having a double link in place for 120 000 records just to exclude 1000 of them, its other kill.

and its not a global accesses table, the table permission is already setup through a parent permission (I have to hide child rows but keep the parent table visible)

rrraaahhh... classic ASP.NET development is missing 🙂

[chleverenz]

Hi @Jerome2 ,

hahahaha - you are right.

Another approach could be to create a virtual entity to filter stuff out and select from there.

A colleague of mine passes in a newly created column (usually text) and has a plugin on retrieve multiple. When he gets data in this column as a condition, he changes the fetch. Also possible.

All solutions hav etheir ad/disad vantages 🙂

Cheers,

  Christian

[Jerome2]

by the way, did you have a reference which explains how I can create a virtual entity on top on dataverse.

I have multiple needs, and be able to easily create "views" on top of my data may be help full.

but from what I can see there is no provider like a loopback connected to the same dataverse environment.

[chleverenz]

Hi @Jerome2 ,

we are rarely using Virtual entities. But when we do create usually like a "bare metal" approach as discussed in the official documentation: https://docs.microsoft.com/en-us/powerapps/developer/data-platform/virtual-entities/custom-ve-data-p... . The last time i did someting is a little bit off but in principle, you can reach any datapoint in the world with the registerd plugin and do whatever you want. You can even do not touch any endpoint at all and just do complicated calculations where the parameters are passed as queryparameters. You could do this also via custom actions, but then not lists would be available out of the box.

There is really one thing you have to keep in mind: whenever the dataverse thinks, it might need data from the virtual entity, it makes a call. For each and every lookup one call.

So, if you have a table having three lookups to your virtual entity it ends up in three calls retrieving your entity. This can really be a great performanceissue on your forms. Especially when you do not know or can guarantee the performance of the externally hosted services.

So, when the external data is needed in the dataverse, virtual entities can be an option. When the external data does not change too often and there are not million of entries, i would go for a custom tabel with the overhead of having the data correctly in place with a flow or (for me better 🙂 ) custom code.

If you only need external data in the portal, i would use hosted services which are authenticated by the portaluser ( https://docs.microsoft.com/en-us/powerapps/maker/portals/oauth-implicit-grant-flow ).

Hope this helps and is not far off the question 🙂

Have fun,

 Christian