fix(hasura): fix hasura permissions

xmlking · Jun 22, 2024 · 1cbc404 · 1cbc404
1 parent 61586c3
commit 1cbc404
Show file tree

Hide file tree

Showing 10 changed files with 239 additions and 89 deletions.
diff --git a/...rc/lib/graphql/QUERY.ListSecurityKeys.gql → .../lib/graphql/QUERY.SearchSecurityKeys.gql b/...rc/lib/graphql/QUERY.ListSecurityKeys.gql → .../lib/graphql/QUERY.SearchSecurityKeys.gql
@@ -1,4 +1,4 @@
-query ListSecurityKeys($userId: uuid!) {
+query SearchSecurityKeys($userId: uuid!) {
   authUserSecurityKeys(where: { userId: { _eq: $userId } }) {
     id
     nickname

diff --git a/nhost/metadata/databases/default/tables/auth_refresh_tokens.yaml b/nhost/metadata/databases/default/tables/auth_refresh_tokens.yaml
@@ -42,14 +42,17 @@ select_permissions:
         - type
         - user_id
       filter:
-        user_id:
-          _eq: X-Hasura-User-Id
+        _and:
+          - user_id:
+              _eq: x-hasura-user-id
+          - type:
+              _eq: pat
 delete_permissions:
   - role: user
     permission:
       filter:
         _and:
           - user_id:
-              _eq: X-Hasura-User-Id
+              _eq: x-hasura-user-id
           - type:
               _eq: pat
diff --git a/nhost/metadata/databases/default/tables/auth_user_providers.yaml b/nhost/metadata/databases/default/tables/auth_user_providers.yaml
@@ -46,3 +46,24 @@ object_relationships:
   - name: user
     using:
       foreign_key_constraint_on: user_id
+select_permissions:
+  - role: user
+    permission:
+      columns:
+        - created_at
+        - id
+        - provider_id
+        - provider_user_id
+        - updated_at
+        - user_id
+      filter:
+        user_id:
+          _eq: x-hasura-user-id
+    comment: ""
+delete_permissions:
+  - role: user
+    permission:
+      filter:
+        user_id:
+          _eq: x-hasura-user-id
+    comment: ""
diff --git a/nhost/metadata/databases/default/tables/auth_user_roles.yaml b/nhost/metadata/databases/default/tables/auth_user_roles.yaml
@@ -34,3 +34,77 @@ object_relationships:
   - name: user
     using:
       foreign_key_constraint_on: user_id
+insert_permissions:
+  - role: manager
+    permission:
+      check:
+        user:
+          defaultOrg:
+            _in: x-hasura-allowed-orgs
+      columns:
+        - role
+        - user_id
+    comment: ""
+  - role: supervisor
+    permission:
+      check:
+        user:
+          defaultOrg:
+            _eq: x-hasura-default-org
+      columns:
+        - role
+        - user_id
+    comment: ""
+select_permissions:
+  - role: manager
+    permission:
+      columns:
+        - role
+        - created_at
+        - id
+        - user_id
+      filter:
+        user:
+          defaultOrg:
+            _in: x-hasura-allowed-orgs
+      allow_aggregations: true
+    comment: ""
+  - role: supervisor
+    permission:
+      columns:
+        - role
+        - created_at
+        - id
+        - user_id
+      filter:
+        user:
+          defaultOrg:
+            _eq: x-hasura-default-org
+      allow_aggregations: true
+    comment: ""
+  - role: user
+    permission:
+      columns:
+        - role
+        - created_at
+        - id
+        - user_id
+      filter:
+        user_id:
+          _eq: x-hasura-user-id
+    comment: ""
+delete_permissions:
+  - role: manager
+    permission:
+      filter:
+        user:
+          defaultOrg:
+            _in: x-hasura-allowed-orgs
+    comment: ""
+  - role: supervisor
+    permission:
+      filter:
+        user:
+          defaultOrg:
+            _eq: x-hasura-default-org
+    comment: ""
diff --git a/nhost/metadata/databases/default/tables/auth_user_security_keys.yaml b/nhost/metadata/databases/default/tables/auth_user_security_keys.yaml
@@ -32,28 +32,6 @@ object_relationships:
     using:
       foreign_key_constraint_on: user_id
 select_permissions:
-  - role: manager
-    permission:
-      columns:
-        - id
-        - nickname
-        - user_id
-      filter:
-        user_id:
-          _eq: x-hasura-user-id
-      allow_aggregations: true
-    comment: ""
-  - role: supervisor
-    permission:
-      columns:
-        - id
-        - nickname
-        - user_id
-      filter:
-        user_id:
-          _eq: x-hasura-user-id
-      allow_aggregations: true
-    comment: ""
   - role: user
     permission:
       columns:
@@ -63,20 +41,7 @@ select_permissions:
       filter:
         user_id:
           _eq: x-hasura-user-id
-      allow_aggregations: true
 delete_permissions:
-  - role: manager
-    permission:
-      filter:
-        user_id:
-          _eq: x-hasura-auth-elevated
-    comment: ""
-  - role: supervisor
-    permission:
-      filter:
-        user_id:
-          _eq: x-hasura-auth-elevated
-    comment: ""
   - role: user
     permission:
       filter:

diff --git a/nhost/metadata/databases/default/tables/auth_users.yaml b/nhost/metadata/databases/default/tables/auth_users.yaml
@@ -113,6 +113,13 @@ array_relationships:
         table:
           name: user_security_keys
           schema: auth
+  - name: userOrgRoles
+    using:
+      foreign_key_constraint_on:
+        column: user_id
+        table:
+          name: user_org_roles
+          schema: public
   - name: userProviders
     using:
       foreign_key_constraint_on:
@@ -126,6 +133,11 @@ computed_fields:
       function:
         name: user_allowed_orgs
         schema: public
+  - name: defaultOrg
+    definition:
+      function:
+        name: user_default_org
+        schema: public
 select_permissions:
   - role: manager
     permission:
@@ -143,16 +155,14 @@ select_permissions:
         - last_seen
         - locale
         - metadata
-        - new_email
-        - otp_hash_expires_at
-        - otp_method_last_used
         - phone_number
         - phone_number_verified
-        - ticket
-        - ticket_expires_at
         - updated_at
-        - webauthn_current_challenge
-      filter: {}
+      computed_fields:
+        - defaultOrg
+      filter:
+        defaultOrg:
+          _in: x-hasura-allowed-orgs
     comment: ""
   - role: supervisor
     permission:
@@ -170,30 +180,68 @@ select_permissions:
         - last_seen
         - locale
         - metadata
-        - new_email
-        - otp_hash_expires_at
-        - otp_method_last_used
         - phone_number
         - phone_number_verified
-        - ticket
-        - ticket_expires_at
         - updated_at
-        - webauthn_current_challenge
-      filter: {}
+      computed_fields:
+        - defaultOrg
+      filter:
+        defaultOrg:
+          _eq: x-hasura-default-org
+    comment: ""
+  - role: user
+    permission:
+      columns:
+        - active_mfa_type
+        - avatar_url
+        - created_at
+        - default_role
+        - display_name
+        - email
+        - email_verified
+        - id
+        - is_anonymous
+        - locale
+        - metadata
+        - phone_number
+        - phone_number_verified
+      computed_fields:
+        - defaultOrg
+      filter:
+        id:
+          _eq: x-hasura-user-id
     comment: ""
 update_permissions:
   - role: manager
     permission:
       columns:
+        - avatar_url
+        - default_role
+        - disabled
         - display_name
-      filter: {}
+        - email
+        - locale
+        - metadata
+        - phone_number
+      filter:
+        defaultOrg:
+          _in: x-hasura-allowed-orgs
       check: null
     comment: ""
   - role: supervisor
     permission:
       columns:
+        - avatar_url
+        - default_role
+        - disabled
         - display_name
-      filter: {}
+        - email
+        - locale
+        - metadata
+        - phone_number
+      filter:
+        defaultOrg:
+          _eq: x-hasura-default-org
       check: null
     comment: ""
   - role: user

diff --git a/nhost/metadata/databases/default/tables/public_organizations.yaml b/nhost/metadata/databases/default/tables/public_organizations.yaml
@@ -11,6 +11,16 @@ configuration:
     allowed_email_domains: allowedEmailDomains
     allowed_emails: allowedEmails
   custom_root_fields: {}
+insert_permissions:
+  - role: manager
+    permission:
+      check: {}
+      columns:
+        - allowed_email_domains
+        - allowed_emails
+        - description
+        - organization
+    comment: ""
 select_permissions:
   - role: manager
     permission:
@@ -29,7 +39,7 @@ select_permissions:
         - organization
       filter:
         organization:
-          _in: x-hasura-allowed-orgs
+          _eq: x-hasura-default-org
   - role: user
     permission:
       columns:
@@ -38,3 +48,35 @@ select_permissions:
       filter:
         organization:
           _in: x-hasura-allowed-orgs
+update_permissions:
+  - role: manager
+    permission:
+      columns:
+        - allowed_email_domains
+        - allowed_emails
+        - description
+        - organization
+      filter:
+        organization:
+          _in: x-hasura-allowed-orgs
+      check: null
+    comment: ""
+  - role: supervisor
+    permission:
+      columns:
+        - allowed_email_domains
+        - allowed_emails
+        - description
+        - organization
+      filter:
+        organization:
+          _eq: x-hasura-default-org
+      check: null
+    comment: ""
+delete_permissions:
+  - role: manager
+    permission:
+      filter:
+        organization:
+          _in: x-hasura-allowed-orgs
+    comment: ""