How to customize the OData server using JayData?

I'm quite new to JayData, so this may sound like a stupid question. I've read the OData server tutorial here: http://jaydata.org/blog/install-your-own-odata-server-with-nodejs-and-mongodb - it is very impressive that one can set up an OData provider just like that. However the tutorial did not go into details about how to customize the provider.

I'd be interested in seeing how I can set it up with a custom database and how I can add a layer of authentication/authorization to the OData server. What I mean is, not every user may have permissions to every entity and not every user has the permission to add new entities.

How would I handle such use cases with JayData?

UPDATE:

Here are two posts that will get you started:

• How to use the odata-server npm module
• How to set up authentication/authorization

The $data.createODataServer method frequently used in the posts is a convenience method that hides the connect/express pipleline from you. To interact with the pipeline examine the method body of $data.createODataServer function found in node_modules/odata-server folder.

---

Disregard text below

Authentication must be solved with the connect pipeline there are planty of middleware for that.

For authorization EntityContext constructor accepts an authorization function that must be promise aware.

The all-allow authorizator looks like this.

  function checkPerm(access, user, entitysets, callback) {
        var pHandler = new $data.PromiseHandler();
        var clbWrapper = pHandler.createCallback(callback);
        var pHandlerResult = pHandler.getPromise();
        clbWrapper.success(true); // this grants a joker rw permission to everyone
        //consult user, entitySet and acces to decide on success/error
        //since you return a promise you can call async stuff (will not be fast though)
        return pHandlerResult;
    }

I have to consult with one of the team members on the syntax that let you pass this into the build up process - but I can confirm this is doable and is supported. I'll get back with the answer ASAP.

Having authenticated the user you can also use EntityContext Level Events to intercept Read/Update/Create/Delete operations.

$data.EntityContext.extend({
   MySet: { type: $data.EntitySet, elementType: Foobar,
            beforeDelete: function(items) {
               //if delete was in batch you'll get multiple items
               //check items here,access this.request.user 
               return false // deny access
            }

});

And there is a declarative way, you can annotate Role names with permissions on entity sets, this requirest that your user object actually has a roles field with an array of role names.