So people are allowed to log in anonymously,
so that means every visitor of our page is logged in,
obviously we don't want to grant many rights to our users then.
And in general, when do we want to enable any data to be fetched,
we need to dive into the rules here and set up the rules for our data.
Now here you have to add a collection and now this does not mean add it in the database but add it in the
rules here so that we can set rules for a collection. If nothing is added here,
everything's locked down by default and that is of course a great security setting.
So here first of all, the databases is the shop database and the collection for which I want to set up some
rules is the products collection.
Now here you see you've got a couple of templates, you can say users can read and write their own data,
users can only read all data, can read and write their own data,
now I will go with no template here,
click add collection and now you have this set up.
Now for one, you could set up some validation here,
you could set up schema validation here and stitch would automatically give you an error if you try
to save something which does not suffice this criteria,
you learned more about schema validation in an earlier module in this course but I'm interested in the permissions.
And here, you basically set for example default permissions which apply to every authenticated entity,
including our anonymously signed in users, so every visitor of our page
and right now, everything is locked down.
Now we can enable read access here and this will allow reading documents in this collection and reading
all fields,
you could even add a field here and you could say well the title is not available for reading it, only
the other fields are,
so that is something you could do if you wanted to control that some field is not retrieveable or not
writeable,
so you got finegrained control up to the field level.
Now here I'm fine with people fetching all documents,
so now we can save that
and now with that, anonymous users should be able to read all the products in our shop database.
So if I go back to my application and I reload here, I don't get this error anymore,
I also don't see the products here
but that is simply related to the fact that I never change the isLoading state here,
so that is a pure react thing.
So here when I set the state, I should also set isLoading to false because we are not loading anymore
and by the way if I have an error, I should also set the state and set isLoading to false because even
if we have an error, we're not loading anymore.
Now with that change, if I save that, now we get a different kind of error,
objects are not valid as react children.
Now that simply is related to what we get back as products,
so let's simply console log our products here to see which format stitch gives us.
So if I now reload, we get this output and we see we are fetching two products because I got two products
in the database from last module and here, I got an array of product with price, name, image and description
and _id which is an object ID.
Now which problem do we have here?
Well the problem is previously in the last module, we parsed our mongodb data on the server,
for example we converted this decimal 128 thing to a number or to a string
we could work with.
Now we're not doing this and hence we're getting these native mongodb types
and you can also see that here that we have these special types, objectId decimal 128 with which we
can't work,
so we need to convert them here on the client
now because we're doing the entire data fetching on the client. The solution is that we transform our
products here on the client, so
let's do this in the next lecture.