0

I am trying to set a "Row Select" permissions on Hasura. I have a (simplified for brevity) Data Model like below

User

id: UserID

App

id: AppID

App Permissions

user_id: User ID
app_id: App ID
permissions: [ ENUM: Admin, View, Owner ]

Feed

app_id: AppID
feed_data: Some Feed Data

Now, I wish to query all Feed for an authenticated user. The query can be of the form

  • GET all apps, for which the authenticated user has view permissions
query MyQuery {
  feed(limit: 10) {
    app_id
    feed_data
  }
}
  • GET apps with app_id in the query filter for which the authenticated user has view permissions
query MyQuery {
  feed(limit: 10, where: {app_id: {_in: [1, 2]}}) {
    app_id
    feed_data
  }
}

Since feed table does not have user_id information directly in it, I can not use X-Hasura-User-Id attribute directly against feed table. I also tried to use _exists relation against the app_permission table, but I am unable to put app_id filter in the permission clause.

{
  "_exists": {
    "_where": {
      "user_id": {
        "_eq": "X-Hasura-User-Id"
      }
    },
    "_table": {
      "schema": "public",
      "name": "app_permission"
    }
  }
}

I am not really sure how to proceed with such data modelling with Hasura. Any help is appreciated. Thanks.

Abhishek
  • 2,543
  • 4
  • 34
  • 46

2 Answers2

1

Since you dont have a direct relationship, I think you can query via appPermissions Table instead of directly querying feeds table.

When you create a feeds table with appId as foreign key relationship, Hasura lets you track this relationship as shown belowenter image description here This way you can make nested graphQL queries to appPerms table as shown below

query GetUserFeeds {
  test_appPerms {
    id
    userId
    feeds(limit: 10) {
      app_id
      id
      feed_data
    }
  }
}

enter image description here

sooraj
  • 324
  • 1
  • 8
  • Thanks @sooraj for answering my question. However, If I need to access some more nested relation, will I have to configure permission for each table? Example - For this example, for role user, if we have feed -> website relation, and I want attributes of website in the QL, will I have to configure permission on both feed and website? Also, to be able to configure permission, I will have to create an object relation from feed, website to app_permission? – Abhishek Jul 02 '21 at 13:11
1

Another thing I'd like to suggest is that you could try is by using a session variable like x-hasura-app-id along side a x-hasura-role and build your permissions around that.

https://hasura.io/docs/latest/graphql/core/auth/authorization/roles-variables.html

Wave Metric
  • 129
  • 1
  • 3
  • 13
  • Hey thanks for your answer. However, I can not pass the app IDs in the JWT claim. The user may get additional permissions to view other apps and an app's permission can be revoked asynchronously. If I do that, I will have to verify the JWT token each time with my Auth server. Not sure if thats a very good idea. – Abhishek Jul 05 '21 at 06:35
  • Sorry I wasn't clear before but these headers would be a part of the request headers an not necessarily the claims map. – Wave Metric Jul 05 '21 at 14:20