The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Build the catalog in YunCMS Studio, then expose only the fields and records intended for anonymous readers through the /items/products REST endpoint. In the example below, the Public role can read active products’ IDs, names, prices, and statuses; it cannot read SKU or stock data or create, update, or delete records. These steps and outcomes come from Yunsoft’s vendor-maintained tutorial, which reports testing YunCMS 0.1.23 on September 30, 2026—not an independent verification of every installation.
What you will build
The workflow uses one collection in three ways: administrators create and manage product records in Studio, an anonymous application reads permitted records through the REST API, and Public-role permissions set the boundary between those views. Yunsoft describes this as a way to keep unfinished products out of public responses.
As an Amazon Associate I earn from qualifying purchases.
The tutorial reports that it verified the workflow on September 30, 2026, with @yunsoft/[email protected], Node.js 24, and MySQL 8.4 in an isolated local installation. It characterizes YunCMS as part of the pre-stable 0.1.x series, so check the exact release and permissions you deploy. See the Yunsoft tutorial for the original walkthrough.
Create the products collection in Studio
- Open Studio’s Data Model and create a collection with the display name
Productsand collection keyproducts. - Keep the recommended system timestamps and user-accountability fields. The example also leaves content navigation enabled.
- Treat
productsas an integration contract once an application uses it: the display name is for people, while the key identifies the collection in API URLs and integrations.
Define fields for the catalog
The example collection uses the following required fields:
#1 Best Overall
| Field | Type and example setting | Purpose |
|---|---|---|
name |
Short text | Product name shown to catalog users |
sku |
Short text | Internal stock-keeping identifier |
price |
Decimal, precision 12 and scale 2 | Product price |
stock |
Integer | Inventory count |
status |
Short text, default draft |
Publication state, using active or draft in the example |
A short-text field does not enforce a closed set of values. If status must be limited to specific values, enforce that through suitable permission rules or application validation. For a catalog that supports multiple currencies, model currency explicitly rather than assuming every price has the same currency.
Add records and check the Studio view
For demonstration, the tutorial adds Canvas Backpack and Ceramic Mug as active products and Desk Lamp as a draft. Studio displays all three to the administrator, along with management fields. These are sample records, not real product recommendations.
Rank #2
- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
Limit anonymous access with the Public role
- Open the Public role’s permissions for the
productscollection and enable read access. - Allow only
id,name,price, andstatus. Leavesku,stock, and system fields unavailable to Public. - Add a row rule that permits records only when
statusequalsactive. - Keep Public create, update, and delete permissions disabled.
The tutorial distinguishes collection navigation visibility from API access: making a collection visible in navigation does not itself grant anonymous API permission. Its example relies on both the field allowlist and the row rule, so a public reader cannot access management-only fields or draft records.
Read the catalog through REST
With the collection key products, the endpoint is /items/products. The example request selects the permitted catalog fields, sorts by product name, and asks for up to 20 records:
Rank #3
GET /items/products?fields=name,price,status&sort=name&limit=20Yunsoft reports that this request returns HTTP 403 before Public read access is granted and HTTP 200 after the permissions are saved. In the example response, the two active products appear while the draft Desk Lamp does not; SKU and stock are absent. The tutorial also reports that decimal prices arrive as JSON strings, so application code should handle currency formatting explicitly.
Use caller filters without widening access
A caller can add a filter to narrow the permitted results. The tutorial demonstrates a price threshold of at least 500: the active Canvas Backpack is returned, while the draft Desk Lamp remains excluded even though its illustrative price meets that threshold. A request filter therefore works within the Public role’s permitted record scope; it does not override the row rule.
Rank #4
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
Connect a frontend and verify the boundary
The tutorial shows server-side JavaScript using fetch to request the endpoint. A browser request from a different origin may also require CORS or routing configuration; a same-origin reverse proxy is another option. Once connected, test the behavior from an anonymous context rather than relying only on what an administrator sees in Studio.
- Request allowed fields and confirm the active records are returned.
- Request
skuorstock; the tutorial reports HTTP 400 withINVALID_QUERY. - Try anonymous create or delete operations; the tutorial reports HTTP 403 with
FORBIDDEN. - Try to request draft records and confirm they remain unavailable; the tutorial reports an empty list for that attempt.
If your installation uses other roles, relations, or write rules, test those flows with representative accounts as well. Permission behavior can depend on the exact release and configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
