Here's the thing. I have the 3 tables depicted here:
People on my application can place orders. Then, I want
rex
permission to see all the orders
table's rowsdelivery
permission to only see the rows of the orders
table that have the zip
column set to the delivery
user's zip
From the orders
table, I can get for each order a zip
. With the table zip_user
, I can get a user_id
out of a zip
. Out of that user_id
, I can get the delivery user from the users
table.
While it is trivial to get the rex
to see all of the orders
table, I have not yet been able to configure the permissions for the delivery
user. What do I need to do?
In other words, given the user performing a select on the orders
table has x-hasura-user-id
set to some user id and x-hasura-role
set to delivery
, how does that user get only the rows from the orders
table that match with the zip
s associated with that user's user_id
?
Hasura has the concept of relations. If you have foreign keys, it makes the relations automatically, if not you can make them yourself in the UI. Once the relationships have been set up, you will be able to set deep permissions, so on the orders
table, you'll be able to use users.id
.
Start here: https://hasura.io/docs/1.0/graphql/manual/schema/relationships/index.html
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.