Implementing custom user permissions in GraphQL and Hasura - permissions

Question

I am creating a webapp that allows users to communicate in several different rooms and am hoping that I can use GraphQL and Hasura for this project. There will be admins which can create/delete rooms (wow-room, lol-Room, pubg-room), create/delete users, and create/delete permissions (admin, wow, lol, pubg) along with assigning roles to users. Users will be able to see any the rooms which they have the permisions to.
The problem is, I want to be sure that only the admins can create/delete these rooms/users/permisions and that only the correct users can see these rooms. Is there a way I can get Hasura to check the permissions of the given user and return the appropriate data? I believe that I need to write a custom resolver but am not sure how that is done or if it is the correct solution.

Answer 1

While Hasura can handle dynamic roles (you can use the API to create new roles and new permission rules on the fly) with Hasura, I think in this case that's not required.
The problem is, I want to be sure that only the admins can
create/delete these rooms/users/permisions and that only the correct
users can see these rooms. Is there a way I can get Hasura to check
the permissions of the given user and return the appropriate data?
Hasura allows you to set a permission rule that traverse relationships which makes this possible. Check out the article-collaborators example in the Hasura docs.
Assuming that your models are rooms, users and room_users and you have the relationships set up so that room.users returns the list of users for a particular room, the permission for a user role on the rooms table can be expressed as follows:
Allow SELECT on a row in rooms if
rooms.users.id: _eq: x-hasura-user-id
This translates to: if a room's users list contains atleast one user_id that is equal to x-hasura-user-id then grant access to that room.
I've set this up on a heroku app: https://multiple-roles-hasura.herokuapp.com/console/api-explorer
Try the following queries out in GraphiQL:
Set the headers to:
x-hasura-role: user
x-hasura-user-id: 1
Run the following query:
query {
rooms {
id
name
}
}
You'll see that the response only contains the rooms that user1 has access to
Switch x-hasura-user-id through different values 1, 2, 3, 4, 5, 6 and you'll see different results for the same query. Basically the right rooms that the only the current user has access to.
Checkout the models and the permissions for the models on:
User & Room mappings: https://multiple-roles-hasura.herokuapp.com/console/data/schema/public/tables/room_users/browse
Room permissions: https://multiple-roles-hasura.herokuapp.com/console/data/schema/public/tables/rooms/permissions