Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Hasura: Allow users to not vote for their own post

Tags:

graphql

hasura

I have three models User, Post, Vote

schema

I tried to create a role-based authorization where the author (the user who creates a post/blog) can't vote for their own post/blog. To identify users, I used Hasura session variables X-Hasura-User-Id. Configuring (Row insert) Permission Rules for Vote table by,

picture

Error:

{
  "errors": [
    {
      "extensions": {
        "path": "$.selectionSet.insert_Vote_one.args.object",
        "code": "permission-error"
      },
      "message": "Check constraint violation. insert check constraint failed"
    }
  ]
}

But which given constraint violation for the author and the other users when they try to vote a post/blog. How to solve that issue for the latter case using Permission Rules?

Update

Auth SetUp

I use one of my auth server(express) to create user and access_token which contain the user.id as Hasura session variables X-Hasura-User-Id.

Then I use this access_token to maintain role-based authorization:

access_token

like image 367
falamiw Avatar asked Dec 10 '20 19:12

falamiw


1 Answers

It seems that you are to make the following rule: X-Hasura-User-Id != Vote.blog.User_id (assuming a hasura relationship called blog for FK Vote.Blog_id).

What you are doing instead is making sure that Vote.User_id != X-Hasura-User-Id. I am assuming the user who submits the vote will always have the same id as themselves. This will always result in a permissions constraint violation.

Unless I misunderstood something...

Let us know if that helps.

like image 70
Abraham Labkovsky Avatar answered Jan 04 '23 06:01

Abraham Labkovsky