How to use x-hasura-allowed-roles with webhooks

Hello, I see there is some documentation on how to use ‘x-hasura-allowed-roles’ with JWT, but I can’t make it work with webhooks. My use case is that each user can have multiple roles, and that I would like to test each of the permissions defined in the console. Here is an example of the payload:

{
  "X-Hasura-Role": "user",
  "X-Hasura-User-Id": "an-user-id",
  "X-Hasura-Allowed-Roles": [
    "manager",
    "user"
  ]
}

In this case, I have an error “expected Text, encountered Array”. But even if I pass a stringified value such as "[manager,user]" or "[\"manager\",\"user\"]" the ‘manager’ permissions don’t apply… Can you tell me if it could work, and if it can, what would be the way to proceed? Thanks in advance!

[plmercereau]

Hello guys, I could not find a simple way to overload the JWT payload with the Hasura claims in loginsrv… The only way I think of would have been to create some kind of JWT proxy between the client and loginsrv, that would decrypt the JWT, add the claims, and generate a JWT - it wouldn’t make any sense then to use loginsrv anymore… So I created this small boilerplate inspired from your webhook passport boilerplate. I basically rewrote a basic auth server that stores user/password in a user table, roles in one another, and creates a many to many relationship through a user_role table. It creates the JWT and maps the roles into x-hasura-allowed-roles. There are of course a few limitations (those identified are detailed in the README), but I hope this will help. Please let me know it there is something I can do to make it useful to someone else.

[ecthiender]

Hi @plmercereau !

The idea is that your webhook is called on every request. Using the data sent by the client, it can resolve the role, per request.

In the case of JWT, the token is issued once the user is authenticated, and that token is used for all subsequent requests, hence it would need to have a list of possible roles for that authenticated user.

Did it make sense?