How to check if the change in nested data is permissible

We have a nested JSON structure in our web app on the frontend like Rows > Columns > Elements > Rows > Columns > Elements ...

We also have an API call which sends the entire data as JSON to backend.

In the backend we have a set of several permissions, like column size change, row background change, element ordering change, etc that are permitted or denied for various types of users.

We want to identify in the backend if the change of the nested structure is permissible.

Example 1 [Update data]:

The user has CHANGED the size of a 'Column', where the size is represented as a property in 'Column' object.

or

Example 2 [Remove/Add data]:

The user has removed/added an 'Element' from a 'Column'.

We know that we can do full traverse on the entire tree, and understand if the change was permissible or not, but we are looking for a better and faster, resource saving solution for concurrent connections and many users/big trees.

----

This question seems to be general for different technologies, but I want to let you know that we are using Laravel / Lumen / Dingo in the backend & Ember.js on the frontend.

Thanks for reading and helping :)

One option is to not send the entire JSON to the server, but to instead send json patch (see

[To see links please register here]

). Then on the server, have rules that affectively hash the paths in the patch to permissions. In other words, since you are only sending the change and not the entire JSON, the need to parse the entir

You can have a API for returning permissions (have model `Permission`).

Then check for that permission for any actions you need in frontend by using [ember-can][1].

By this, you can ensure that when you send back data for updating from front to back, it is complying the permissions defined in backend and no need for many back n forth


[1]:

[To see links please register here]

I think you can have type for each change. For example column change is ----> colChange(or simpleChange). Send the type of change with json. Permission can be checked by change type. Also there can be groups of change types and permission can be sat to groups. In case if you don't send data for each change there must be stack of user changes(push type of change into stack on each user change). Send that stack with json to backend .