access control: how to use "_in" with x-hasura-allowed-roles or other session variables in permissions

version: alpha34

Here is my jwtoken:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwczovL2hhc3VyYS5pby9qd3QvY2xhaW1zIjp7IngtaGFzdXJhLWFsbG93ZWQtcm9sZXMiOlsiYWRtaW4iLCJ1c2VyIl0sIngtaGFzdXJhLWRlZmF1bHQtcm9sZSI6InVzZXIiLCJ4LWhhc3VyYS11c2VyLWlkIjoiMSJ9LCJpYXQiOjE1NDY2MDY5MzR9.-dfaH0ZG8gXbSMUn_m8LMkKdEdAk7NauqQqhI_yBnS0

which payload in clear is:

{
  "https://hasura.io/jwt/claims": {
    "x-hasura-allowed-roles": [
      "admin",
      "user"
    ],
    "x-hasura-default-role": "user",
    "x-hasura-user-id": "1"
  },
  "iat": 1546606934
}

In the console, permission tab, I’m setting this:

{"role":{"_in":["X-HASURA-ALLOWED-ROLES"]}}

But obviously it dosn’t work.

On the other hand, using {"role":{"_eq":["X-HASURA-ROLE"]}} works (but if user has multiple roles, using this permission only get me back data for the current role. I’d like to get data related to all user roles).

I’m I missing something on how to use arrays? Many Thanks!

[sulliwane]

Thanks a lot. I think array support in JWT/HEADERS could be very useful (especially to simplify overall design and logic in some cases). I already upvoted the related issue.

I had a look at your example (thanks for deploying it!), and that’s also a very good way to solve this problem. It requires though to add one join table with corresponding relationships for each extra table that needs control access (if my understanding is correct). But why not.

Access Control is a Pandora Box and there isn’t any silver bullet (especially when developing a one size fits all approach). Keep up the good work! 😃

[pilatte]

For string columns you can send "X-Hasura-Variable":(${IdArray.join("|")}) Then restrict

{
    id: _similar: "X-Hasura-Variable"
}

It is a REGEX-like. id1 will match (id1|id2|id3) but not id4 Only works for strings tho.

check issue #1333 to see the advancement on this.