A simple data storage schema to restrict public access

Question

I have been working on a library which enable a website to add a comment section to their website.

The idea was to keep it as lightweight as possible thus I preferred to use JSON for basic data storage like comment's message, website and username. All of these data is public and can be access directly via JSON. I don't mind this since comments are going to get display publicly anyway.

However, the problem arises when I want a user to be notified when someone replies to their comment. Email is there in input field but I don't want it to be stored in the public JSON file. Is there any other server side data storage schema where I can store the email privately and at the same time use those emails from server side scripts to send email?

MySQL and others will make the library clunky, so that's out of the list.

Or even beside these conditions is there any other possible way to do this?

Answer 1

What you need is APIs and not a data source. A data source is a truth where all data lives. Like in your example, if you have email in your data, it will always be there. Unless you keep email field separately.

1. The way is to create api that will output required data from JSON files (or database). You can choose to hide the data that you don't want to show. This way, you only expose the api, instead of the file name directly, which has risks of being modified or altered or hacked very easily.

2. Other way without using API is to have multiple JSON files. One file will have basic data, and other will have confidential data, along with a foreign key like unique key that'd map the confidential or other data with the main record.

Example: Comments.json:

{
  "comments": [{userId: 1, ...},{...}]
}

CommentDetails.json

{...}

Users:

[
  1: {"username": "", "email": "[email protected]",...}
]