vcaw
/
public
forked from root/public
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Browse Source

adding table to db-authorization documentation

content-update
lee 3 years ago committed by Clément
parent
f0a9a35a5f
commit
5cddb22c0d
1 changed files with 201 additions and 35 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 236
      docs/db/db-authorization.md

236
docs/db/db-authorization.md
unescape_control_characters View File

@ -1,8 +1,6 @@
# DB authorization
Every request to Hasura executes against a set of session variables. These variables are expected to be set by the authentication system.
Normally there are some main variables for the authorization context:
Every request to Hasura executes against a set of session variables. Normally there are some main variables for the authorization context:
- `X-Hasura-User-Id`: this variable usually denotes the user executing the request.
@ -13,49 +11,217 @@ Normally there are some main variables for the authorization context:
In our database we have several roles which are simple arbitrary names.
Each role can be given a set of permissions and actions (`select`, `insert`, `update`, `delete`). That will execute against each table of the database.
Example:
To give the user with a certain role a permission to make a request, we must set a permission rule that would look something like this:
```json
{"user_id": {"_eq": "X-Hasura-User-Id"}}
{ "user_id": { "_eq": "X-Hasura-User-Id" } }
```
This is the same as saying : if the value of the `user_id` column equals the value of the session variable `X-Hasura-User-Id`, allow this request to execute on the current row.
It is possible to express pretty complex rules, by using, for example the operators `_and` and `_or` to create a chain rule. It is even possible to query tables not related to the current object as part of the rule execution. You can see more about it [here](https://hasura.io/docs/latest/graphql/core/auth/authorization/index.html).
This is the same as saying : if the value of the `user_id` column equals the value of the session variable `X-Hasura-User-Id`, it allows this request to execute on the current row and get information on that user id.
## Roles
These are the roles presented in the database:
- `anonymous`: this role allows non logged in users to query (only using `select`) tables:
- `users` : and columns `id`, `login`
- `object` : and columns `id`, `childAttr`, `campus`, `name`, `type`
- `result` : and columns `groupId`, `objectId`, `progressId`, `userId`, `grade`, `campus`
- `transactions` : and columns `objectId`, `userId`, `amount`, `type`
- `progress` : and columns `isDone`, `objectId`, `userId`, `id`, `grade`, `campus`
- `user` : this role allows the following queries:
- without check:
- `group`, `group_user`, `match`, `registration_user`, `event`, `event_user`, `object`, `object_child`, `object_status`, `object_type`, `registration`, `role`, `transaction_type`
- with checks:
- `audit`, `result`, `transaction`, `user_role`, `user`, `progress`
- `anonymous`: this role allows non logged in users to query tables (only using the `select` action):
- `campus-admin` : this role allows users to query every table, but with the session variables `X-Hasura-campus` check. This means that users with this role will only be able to query information from their own campus.
- `users` : columns `id`, `login`
- `object` : columns `id`, `childAttr`, `campus`, `name`, `type`
- `result` : columns `groupId`, `objectId`, `progressId`, `userId`, `grade`, `campus`
- `transactions` : columns `objectId`, `userId`, `amount`, `type`
- `progress` : columns `isDone`, `objectId`, `userId`, `id`, `grade`, `campus`
- `admin-campus-read-only` : this role allows users to query almost all tables with a campus permission verification.
---
Example:
```json
{ "campus" : { "_in" : "X-Hasura-campus" } }
```
- `admin` : this role allows users to query any action in any table on the database.
- `admin-read-only` : this role allows users to query almost all tables only using the `select` action.
This is how the user and role tables are related to each other:
- `user` : this role allows the following queries:
![alt text](../img/db/user-roles.jpg "hierarchical roles")
- `selects` action:
- without permission rules:
- `event_user`
- `group`
- `group_user`
- `match`
- `registration_user`
- `event`
- `object`
- `object_child`
- `object_status`
- `object_type`
- `registration`
- `role`
- `transaction_type`
- _`event_user_view`_
- _`object_children_view`_
- _`registration_user_view`_
- _`user_public_view`_
- with permission rules:
- `audit`, the user only can query this table if the user id from the `X-Hasura-User-Id` variable is equal to one of the `members`, or the `auditorId`.
- `result`, the user only can query this table if the `X-Hasura-User-Id` is equal to the `userId` or one of the members from their group.
- `transaction`, this table can be queried by users if the `X-Hasura-User-Id` is equal to the `userId`.
- `record`, the same applies to this table and the tables below.
- `progress`
- `user_role`
- `user`, the same applies to this table but with the `id`.
- _`user_role_view`_
- _`audit_private`_
- _`progress_by_path_view`_
- _`progress_view`_
- _`xp`_
- _`xp_by_event`_
- _`xp_by_object`_
- _`xp_by_path`_
---
- `campus-admin` : this role allows users to query every table, but with the variables `X-Hasura-campus` checked (campus check). This means that users with this role will only be able to query information from their own campus. Example: a user in campus `madere` can only query the content associated to that campus. The following tables can be queried:
- `select` action:
- without permission rules:
- `group_status`
- `object_status`
- `object_type`
- `result_type`
- `role`
- `transaction_type`
- `user_role`
- _`user_public_view`_
- _`user_role_view`_
- with permission rules:
- `event_user`
- `audit`
- `group`
- `group_user`
- `match`
- `object`
- `event`
- `progress`
- `record`
- `registration`
- `registration_user`
- `result`
- `transaction`
- `user`
- _`progress_by_path_view`_
- _`audit_private`_
- _`event_user_view`_
- _`event_with_results_ready_view`_
- _`progress_view`_
- _`registration_user_view`_
- _`registration_with_event_ready_view`_
- _`toad_result_view`_
- _`xp_by_event`_
- _`xp_by_object`_
- _`xp_by_path`_
---
- `campus-admin-read-only` : this role allows users to query almost all tables (only using the `select` action). But with the same permission rule in the `campus-admin`. The following tables can be queried:
- without permission rules:
- `group_status`
- `object_status`
- `object_type`
- `result_type`
- `role`
- `transaction_type`
- `user_role`
- _`user_public_view`_
- _`user_role_view`_
- with permission rules:
- `event_user`
- `audit`
- `group`
- `group_user`
- `match`
- `object`
- `event`
- `progress`
- `record`
- `registration`
- `registration_user`
- `result`
- `transaction`
- `user`
- _`progress_by_path_view`_
- _`audit_private`_
- _`event_user_view`_
- _`event_with_results_ready_view`_
- _`progress_view`_
- _`registration_user_view`_
- _`registration_with_event_ready_view`_
- _`toad_result_view`_
- _`xp_by_event`_
- _`xp_by_object`_
- _`xp_by_path`_
---
- `admin-read-only` : this role allows users to query all tables only using the `select` action.
---
- `admin` : this role allows users to query using any action in any table on the database.
> You can see more about each role by going to the [graphiql](https://[[DOMAIN]]/graphiql) in the docs section. Note that you must be logged in with the user role you desire to see. For the role `anonymous` you do not need to be logged in. If you want to see the possible tables that can be queried by an admin, you must login with an admin, and so on...
This table can describe the permissions for each table of the database and each user role.
✅ : with permission rules\
🟩 : without permission rules\
❌ : not allowed\
S : select\
U : update\
I : insert\
D : delete
| tables | `anonymous` | `user` | `campus-admin` | `campus-admin-read-only` | `admin` | `admin-read-only` |
| :--------------------------------- | :------------------------------ | :------------------------------ | :------------------------------ | :------------------------------ | :------------------------------ | ------------------------------- |
| | S  U  I  D  | S  U  I  D  | S  U  I  D  | S  U  I  D  | S  U  I  D  | S  U  I  D  |
| event_user | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| audit | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| group | ❌ ❌ ❌ ❌ | 🟩 ✅ ✅ ✅ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| group_user | ❌ ❌ ❌ ❌ | 🟩 ✅ ✅ ✅ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| match | ❌ ❌ ❌ ❌ | 🟩 ✅ ✅ ✅ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| progress | 🟩 ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| record | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| registration_user | ❌ ❌ ❌ ❌ | 🟩 ❌ ✅ ✅ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| result | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| transaction | 🟩 ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| user | 🟩 ❌ ❌ ❌ | ✅ 🟩 ❌ ❌ | ✅ ✅ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| audit_expired_view | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| audit_private | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| discordToken | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| event | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| event_user_view | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| object | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| event_with_results_ready_view | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| group_status | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| job | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| match_to_remove_view | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ✅ ✅ ✅ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| object_child | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ❌ ✅ ✅ ✅ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| object_children_view | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| object_status | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| object_type | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| progress_by_path_view | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| progress_view | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| registration | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| registration_user_view | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| registration_with_event_ready_view | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| result_type | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| role | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| toad_result_view | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| token | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| token_status | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| transaction_type | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| user_public_view | ❌ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| user_role | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| user_roles_view | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | 🟩 ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| xp | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ❌ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| xp_by_event | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| xp_by_object | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |
| xp_by_path | ❌ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ❌ ❌ ❌ | ✅ ✅ ✅ ✅ | ✅ ❌ ❌ ❌ |

Write Preview
Loading…
Cancel
Save