Public APP and User Functions

[Saraappsheet]

Hi I need advice about public app.currently I'm building a public app that has one admin.

This is for a store,  When customers come they will install the app and use it without email login restriction.  The public app method in appsheet.

But, I want them to see only their orders after they placed the order, my confusion is if they log in without email restriction how would useremail() based view/filters works? in public app if data filter security works?

Anyway when customer place the order they are asked to fill their email too, I have given that email based filtering view. but will that work same in the public app mode also?

appreciate your advice

[Steve · Accepted solution]

Not AppSheet.

[okutani_hayato]

If Public, no security filters are available.

https://support.google.com/appsheet/answer/10106760?hl=en

It is recommended to use USERSETTINGS which sets unique values per device.

[Saraappsheet]

Can you advice how should i do in my case? the technical part?

I have one admin email, and the rest are going to be public how should I do this?

[okutani_hayato]

Create admin and public apps separately. Use the same data source.

Public
Filter by USERSETTINGS
Use the slice function, as security filters cannot be used.
The values of the items set in USERSETTINGS are
USERSETTINGS("column name") or [_THISUSER].[""column name]
can be obtained with

Examples
- Added user_email to order table.
・Set email as one of the items in USERSETTINGS.
・Use slice and set the condition to [user_email] = USERSETTINGS("email").
・Use after registering with USERSETTINGS for customers.

By doing the above settings, Public will also display orders filtered by user.

[Saraappsheet]

Thanks for your time and effort,

"Use after registering with USERSETTINGS for customers"  this part is not clear.

[okutani_hayato]

Go to USERSETTINGS, check show and save.

After saving, a View called Setting will be displayed in the Menu.

Users on the Public side must first register their e-mail etc. in Settings before using it.

Need a sample?

[Saraappsheet]

I’m aware of usersetting configuration. So you are telling that customer
has to feed their email in usersetting view before log to the orders, am I
right?

In this case I just need to create a feild for user email right no formulas
required.

[okutani_hayato]

Public の場合、Security Filter は使用できないため、代わりに Slice を使用する必要があります。

メールアドレスの設定は一例で、USERSETTING 列は名前にすることもできます。

名前が重複している可能性があります。

dbaum

Public はすべてのデータをすべてのユーザーのデバイスに送信することに注意してください。

[dbaum]

Bear in mind that the technique of filtering displayed data based on a USERSETTINGS value does not actually secure the data. For one, any user could enter another customer's email address and see the other customer's orders. In a public app, there's no authentication that the user entering an email address actually owns that email address. Furthermore, even aside from the scenario of one user entering another's email address, all users' data will always be downloaded to every user's device. The slice filter only controls what's displayed via the app--it doesn't change what's downloaded from the server to the app on the user's device.

[Steve]

There is NO WAY to create a secure app using the public plan. You WILL be exposing private user information to the public. What you are attempting with the public plan is irresponsible and likely a violation of the AppSheet terms of service.

[Saraappsheet]

Hi Steve, What would you recommend if I need an app that should be accessed by any number of people without login requirement or (easily installed way) in order to make their order when they visit store.. it's a self-ordering system.

[Steve · Accepted solution]

Not AppSheet.

[dbaum · Accepted solution]

A few alternatives to consider investigating.

[1minManager]

What about if the App is only there to collect/upload information such as by using "Filter out all existing rows?" on the table settings?  So the App user only interacts with the App via uploading information.  Appsheet then does all the clever stuff using bots and the data to email the person using the app to show them specific data.

[Saraappsheet]

You mean then they will see their current data which they enter and it won't show any history to them right?

[1minManager]

No.  With this option it allows you to associate each bit of data to a unique user.  But this is just for imputting data, if you want to be safe.  If you did this any wanted to show the data on screen then that to me would not be secure

[MultiTech]

---

@Steve wrote:

likely a violation of the AppSheet terms of service

---

Bears repeating

---------------------------------------------------------------------------------------------

    Couldn't resist (^_^)

[1minManager]

The only way for them to uniquely identify themselves in a public app would be to use either a barcode, QR Code, NFC tag or password.  

[Steve]

---

@1minManager wrote:

What about if the App is only there to collect/upload information such as by using "Filter out all existing rows?" on the table settings?  So the App user only interacts with the App via uploading information.  Appsheet then does all the clever stuff using bots and the data to email the person using the app to show them specific data.

---

When using Filter out all existing rows?, the entire app--even the bots--don't have access to the collected data, so you'd have to have a second app that uses scheduled bots to work the data, which is not an approach I would recommend.

[1minManager]

Even if "Bypass Security Filters?" is turned on for the bot?

[Steve]

I'm pretty sure Bypass Security Filters doesn't affect Filter out all existing rows, but it's been a long time since I tested it. Filter out is available on all plans, but security filters aren't, so I suspect the two features are independent.

[1minManager]

Just done a quick test.  "Bypass Security Filters doesn't affect Filter out all existing rows" is correct.  So the only way is either another app looking at the same data, the Appsheet API, or maybe a Google Appscript