Hasura object permission based authorization

Question

I am trying to set a "Row Select" permissions on Hasura. I have a (simplified for brevity) Data Model like below

User

id: UserID

App

id: AppID

App Permissions

user_id: User ID
app_id: App ID
permissions: [ ENUM: Admin, View, Owner ]

Feed

app_id: AppID
feed_data: Some Feed Data

Now, I wish to query all Feed for an authenticated user. The query can be of the form

• GET all apps, for which the authenticated user has view permissions

query MyQuery {
  feed(limit: 10) {
    app_id
    feed_data
  }
}

• GET apps with app_id in the query filter for which the authenticated user has view permissions

query MyQuery {
  feed(limit: 10, where: {app_id: {_in: [1, 2]}}) {
    app_id
    feed_data
  }
}

Since feed table does not have user_id information directly in it, I can not use X-Hasura-User-Id attribute directly against feed table. I also tried to use _exists relation against the app_permission table, but I am unable to put app_id filter in the permission clause.

{
  "_exists": {
    "_where": {
      "user_id": {
        "_eq": "X-Hasura-User-Id"
      }
    },
    "_table": {
      "schema": "public",
      "name": "app_permission"
    }
  }
}

I am not really sure how to proceed with such data modelling with Hasura. Any help is appreciated. Thanks.

Answer 1

Since you dont have a direct relationship, I think you can query via appPermissions Table instead of directly querying feeds table.

When you create a feeds table with appId as foreign key relationship, Hasura lets you track this relationship as shown below This way you can make nested graphQL queries to appPerms table as shown below

query GetUserFeeds {
  test_appPerms {
    id
    userId
    feeds(limit: 10) {
      app_id
      id
      feed_data
    }
  }
}

Answer 2

Another thing I'd like to suggest is that you could try is by using a session variable like x-hasura-app-id along side a x-hasura-role and build your permissions around that.

https://hasura.io/docs/latest/graphql/core/auth/authorization/roles-variables.html