handle different roles in hasura

Question

ok, so my tables are like this:

user {
  id
  username
}

job {
  id
  title
  posted_by
  applications
}

application {
  id
  applicant_id
  details
  status
}

where:

every user can post a job
a user can only edit his own posted jobs (posted_by)
a user can apply to any job that he didn't post
a user can delete his own applications
a job poster can accept (change status) of applications to his own posted jobs

that means that a user should have different roles based on the application. if he posted the job then he's a "job poster" and if he posted the application then he's an "applicant".

I thought that if I define these roles on the applications table, he'll be assigned dynamically, based on the application he's trying to update, but it didn't work. reading through the Hasura docs I see that it's based on X-Hasura-Role that is defined in the JWT token that is generated on login, but the user can have two roles.

I also tried to defined two rows for the role user, that each will define what he can update, but that's not working too.

I've read into https://hasura.io/docs/latest/graphql/core/auth/authorization/index.html without any answer. I'll continue reading through https://hasura.io/docs/latest/graphql/core/auth/authentication/jwt.html

Thanks for reading, Chaim

user_681629 · Answer

Found the solution. It's related to X-Hasura-Role. When making the request we need to tell the server which role we expect to apply this action with. If the role isn't in our JWT claim x-hasura-allowed-roles then the action will default to x-hasura-default-role.

so what I do is (apollo-client):

useMutation(MUTATION, {
  context: {
    headers: {
      'x-hasura-role': 'poster'
    }
  }
}

I hope this helped someone. Would love to hear about another solution

handle different roles in hasura

1 Answers