backbone-aura event emmission

Question

I have recently started learning backbone and aura and tried out a simple app using both. I have three widgets, say A, B and C. Now A and B publish events (using sandbox.emit) and C subscribes to them (using sandbox.on). 'A' publishes "A.eventA" and 'B' publishes "B.eventB" say. I tried publishing "B.eventB" from widget A and it still works. So, is there a way using which widgets cannot publish any events except there own events ? (Or is this allowed/expected behaviour ?)

Thanks.

Answer 1

What you're asking about is security. Aura's design is to have a facade that handles security. Instead of hitting the mediator's publish directly, you call it through the facade. The facade first checks that you have permission to publish.

Here's an example from https://gist.github.com/addyosmani/1518268 which shows security for subscribe. You could use something similar for publish.

define([ "../aura/mediator" , "../aura/permissions" ], 
       function (mediator, permissions){

    var facade = facade || {};

    facade.subscribe = function(subscriber, channel, callback){

        // Note: Handling permissions/security is optional here
        // The permissions check can be removed 
        // to just use the mediator directly.

        if(permissions.validate(subscriber, channel)){
            mediator.subscribe( channel, callback );
        }
    }

    facade.publish = function(channel){
        mediator.publish( channel );
    }
    return facade;

});