DOCSEARCHbyAlgolia
Submit Docs

Devii Documentation

website·Indexed 32 days ago

https://docs.devii.io

Devii provides a security engine for access control and rights management over SQL-based external database connections. It features a Policy-Based Access Control (PBAC) system, OIDC authentication support, GraphQL integration, and a built-in blob storage system for file handling. The platform includes a Devii Portal for tenancy and role management, as well as NLAPI for natural language interaction with relational databases.

Tokens
49.5K
Snippets
184
Records
341
Agent score
58%

What's inside Devii

  1. Overview of Devii Policy-Based Access Control (PBAC)

    Devii uses a 'default deny' security model where access is only granted if a matching policy rule exists. Rules cannot be used to explicitly deny access; instead, the absence of a granting rule results in denial. A rule consists of a scope (who and what), a set of capabilities (what operations), and an optional filter expression that modifies the data returned or acted upon.

  2. Overview of Devii API Engine

    Devii is an instant API engine designed to reduce the time and cost of building and maintaining GraphQL APIs. It provides built-in policy-based security for scalability and offers instant API access and cloud hosting for popular databases, including MySQL, Oracle, and PostgreSQL.

  3. Overview of Devii Webhook Rules

    Webhook rules allow you to automatically send HTTP requests to external services when data in your database tables is inserted, updated, or deleted. This enables real-time integration without polling. Each rule is defined by target tables, triggering operations (insert, update, delete, upload), and parameters for the request (URL, method, headers, and payload).

  4. Overview of OIDC Authentication in Devii

    Devii supports authentication via OpenID Connect (OIDC) providers (e.g., Google, AWS, Microsoft Entra ID). Instead of storing credentials locally, Devii verifies identity tokens from an external provider and maps the user to a Devii role using a configured comparison field.

    Role-based Access for OIDC Configuration:

    • pxadmin (installation root): Can create OIDC providers.
    • Tenant root roles: Can create OIDC configurations.
    • Users with role creation privileges: Can create role_oidc mappings for others.
    • All users: Can create/update their own mappings.

  5. Overview of Devii Filter Expression Language

    Devii uses a custom domain-specific language (DSL) for filtering data on its GraphQL query and Aggregates endpoints. This language is similar to a SQL WHERE clause but is not standard SQL or JSON/GraphQL filter syntax. It is passed as a string argument to the filter field of a GraphQL query. Note that mutations do not support filter arguments; use the id field for targeted updates or deletes.
    # Example Query
{
  people(filter: "name='Boba Fett'") {
    name
    birthYear
  }
}

# Example Aggregate
{
  Aggregates {
    avg(subquery: "query{films{budget}}")
  }
}

  6. Understand Devii Role and Capability fundamentals

    In Devii, Roles are used to represent both individual users and groups. Every user accessing a tenant schema must do so through a role. Roles determine both the operational 'powers' (capabilities) a user has and their access to specific data objects via ACLs. A role with no capabilities is considered 'read-only', meaning it can only access data objects it has ACLs for, and those permissions are treated as read-only regardless of the ACL settings.

  7. Generate GraphQL APIs from SQL databases with Devii Server

    Devii Server provides automatic GraphQL schema generation for popular SQL databases. Key capabilities include:

    • Automatic generation of resolvers for queries and mutations.
    • A filter expression language for queries.
    • Support for result ordering, Limit, and Offset.
    • Support for aggregate queries.

  8. Understand the Devii file upload and validation lifecycle

    Devii uses a multi-step process to handle file uploads and validation:

    1. Initiation: The client creates a record using the FileUpload GraphQL type to receive an upload URL and headers.
    2. Upload: The client uploads the file to the provided remote storage (e.g., Google Storage).
    3. Server-Side Validation: A background process monitors records with a pending status. It validates the file blob's existence, MIME type, and size.
      • OK: If MIME type and size match the record, status becomes ok. Devii then provides download URLs via the thefiles attribute.
      • Invalid: If there is a MIME type discrepancy or the size exceeds the recorded value, status becomes invalid.
      • Pending: If the blob is missing or the size is smaller than expected, it remains pending. Only upload URLs are provided in this state.
    4. Client Verification: The client typically triggers a fetch on the model after upload to verify the status has transitioned from pending to ok.

  10. Perform data aggregation using Aggregates

    Devii provides an Aggregates object to perform common mathematical operations on a subquery. The available aggregate functions are:

    • avg: Calculates the average of a field.
    • count: Counts the number of objects.
    • max: Finds the maximum value.
    • min: Finds the minimum value.
    • sum: Calculates the total sum of a field.

  11. Devii Core and Package Functionality Overview

    Devii is divided into a core engine and optional functional packages:

    Devii Core Handles basic GraphQL schema generation, querying, mutations, tenant management, roles, role classes, policy rules, and the expression language parser/evaluator.

    Available Packages

    • Multimedia: Manages file associations with records using signed URLs for upload/download via Cloudstorage (Azure Blob, GCS, S3, or on-premises).
    • Geospatial: Adds geometry/geography types and geospatial functions to query filters. Uses OGC Well-Known Text format.
    • Geoimaging: Renders geospatial rasters and performs image processing via process rules.
    • Alerts: Sends email/SMS notifications on table changes via process rules.
    • Reporting: Generates HTML/PDF reports using JavaScript templates via process rules.
    • Financials: Integrates payment gateways (e.g., BNG Holdings NMI-compatible API) for content purchase and subscriptions via process rules.
    • Aggregate Queries: Provides server-side aggregates (avg, count, max, min, sum) with grouping and expression-based filtering.
    • Function and Procedure Calls: Exports database functions and stored procedures through the GraphQL API, controlled by the policy rule engine.

  12. Understand the relationship between Website Terms and SaaS Terms

    The Website Terms of Service govern the use of the Devii website (the Site). However, if you use a Devii software-as-a-service (SaaS) offering, such as the Devii Standard Offering ('Standard Plan'), your use is governed by the applicable service-specific terms (e.g., Devii Standard Offering Terms of Service, Commercial, or Enterprise contracts). In the event of a conflict, the service-specific terms take precedence over the Website Terms.