# ACL as a pointer? (toggle private/public data) **URL:** \ **Category:** Parse Server 📡\ **Created:** [May 12, 2022, 7:56pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663 "2022-05-12T19:56:18Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![pwnedev](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/p/b38774/32.png) [@pwnedev](https://community.parseplatform.org/u/pwnedev)\ **Post date:** [May 12, 2022, 7:56pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/1 "2022-05-12T19:56:18Z")
Hey there, I would like to know if it’s possible to assign an ACL has a Pointer. (Or if there is a better way to achieve what I’m trying to do) Context: I got a **Posts** table and a **Users** table. Each post belongs to an user. A user can have multiple posts. I want to give the user the option to hide all his posts. Problem: If the user has 1000 posts, changing the ACL “PublicRead” to false is costly in terms of resources, because we have to update 1000 rows. However, if I could define all those posts ACL to a pointer in the user table, I could just update 1 row instead. Thanks in advance ---
**Author:** ![tayloruk](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/t/51bf81/32.png) [@tayloruk](https://community.parseplatform.org/u/tayloruk)\ **Post date:** [May 14, 2022, 7:50pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/2 "2022-05-14T19:50:06Z")
I think the best approach would be to assign a role to each of the posts and then you can just change the Role ACL in one place and all the Posts will respect the ACL of the Role that they have assigned to them. ---
**Author:** ![pwnedev](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/p/b38774/32.png) [@pwnedev](https://community.parseplatform.org/u/pwnedev)\ **Post date:** [May 14, 2022, 7:51pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/3 "2022-05-14T19:51:21Z")
That way I need to have 1 role per user. 1 million roles is kinda messy no? ---
**Author:** ![tayloruk](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/t/51bf81/32.png) [@tayloruk](https://community.parseplatform.org/u/tayloruk)\ **Post date:** [May 14, 2022, 7:55pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/4 "2022-05-14T19:55:24Z")
I must admit I have a similar issue - see here for my initial post: [Suggested strategy for sharing objects between users](https://community.parseplatform.org/t/suggested-strategy-for-sharing-objects-between-users/1547) My approach at the moment is to change the ACL on all the user’s objects (i.e. posts in your use case), which is not ideal as I have the same problem that you had identified, updating 1000 objects is a pain! ---
**Author:** ![pwnedev](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/p/b38774/32.png) [@pwnedev](https://community.parseplatform.org/u/pwnedev)\ **Post date:** [May 14, 2022, 8:00pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/5 "2022-05-14T20:00:57Z")
Sounds like a pointer ACL could do wonders, not sure how hard it would be to implement it tho ---
**Author:** ![tayloruk](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/t/51bf81/32.png) [@tayloruk](https://community.parseplatform.org/u/tayloruk)\ **Post date:** [May 14, 2022, 8:07pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/6 "2022-05-14T20:07:28Z")
Pretty difficult I expect, ACLs seem (to me) to be interwoven into the fabric of Parse. It would be great to hear what @davimacedo has to say about it. ---
**Author:** ![davimacedo](https://community.parseplatform.org/user_avatar/community.parseplatform.org/davimacedo/32/316_2.png) [@davimacedo](https://community.parseplatform.org/u/davimacedo)\ **Post date:** [May 17, 2022, 2:13pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/7 "2022-05-17T14:13:29Z")
Parse Server has pointer permission ([REST API Guide | Parse](https://docs.parseplatform.org/rest/guide/#pointer-permissions)) which is helpful but I don’t think it would cover your use-case, because, as long as I understood, you want a flag to hide/unhide the posts. In this case, I’d either go with a Role per user or a beforeFind trigger. ---
**Author:** ![pwnedev](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/p/b38774/32.png) [@pwnedev](https://community.parseplatform.org/u/pwnedev)\ **Post date:** [May 17, 2022, 7:17pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/8 "2022-05-17T19:17:21Z")
Thanks for the reply! **Role** approach: Wouldn’t 1million roles (if 1 million users) be a bad idea? Couldn’t it cause performance issues? **beforeFind** approach: If posts are set to public, then I let users read it, if private, I throw. How should I setup the ACL tho? Still PublicRead(true)? I want to make sure **beforeFind** will prevent everyone from reading it if private. Is there anything else I should be concerned about to make sure the posts can’t be read by anyone else but the user when posts should be private? Thanks in advance! ---
**Author:** ![Frank500](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/f/e274bd/32.png) [@Frank500](https://community.parseplatform.org/u/Frank500)\ **Post date:** [May 18, 2022, 7:59am UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/9 "2022-05-18T07:59:52Z")
A different angle: Make the option to hide all posts an async cloud function/job and show the user a message “posts will be hidden within the next minutes”. ---
**Author:** ![pwnedev](https://community.parseplatform.org/letter_avatar_proxy/v4/letter/p/b38774/32.png) [@pwnedev](https://community.parseplatform.org/u/pwnedev)\ **Post date:** [May 18, 2022, 12:03pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/10 "2022-05-18T12:03:28Z")
Yea I rather not waste resources like that but thanks! Also that’s exactly what I’m trying not to do ---
**Author:** ![davimacedo](https://community.parseplatform.org/user_avatar/community.parseplatform.org/davimacedo/32/316_2.png) [@davimacedo](https://community.parseplatform.org/u/davimacedo)\ **Post date:** [May 18, 2022, 3:41pm UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/11 "2022-05-18T15:41:30Z")
- 1 million roles shouldn’t be a problem in my point of view - for beforeFind, you would leave ACL always public and filter hidden posts out using the trigger - A third idea could be everything private via CLP and always read the posts via a cloud code function that would create the query according with the hidden/unhidden flag. ---
**Author:** ![simoyw](https://community.parseplatform.org/user_avatar/community.parseplatform.org/simoyw/32/331_2.png) [@simoyw](https://community.parseplatform.org/u/simoyw)\ **Post date:** [May 20, 2022, 8:46am UTC](https://community.parseplatform.org/t/acl-as-a-pointer-toggle-private-public-data/2663/12 "2022-05-20T08:46:54Z")
I had a similar issue and I solved it with the cloud code. In this case is much easier e much more customizable. ACL are good for other simpler use cases.