Field Authorization level with Postgraphile

Question

Currently, I'm working with Postgraphile and I need to enforce permissions at data/field level.

For example, I have a carmodel table, with my query is something like:

{
   carmodel
      {  
         id
         name
         description
      }
}

Well, in this table I have ids (1 = AUDI, 2 = GM, 3 = BMW) The current user (on roles/claims) has permission only to see (1=AUDI/3=BMW)

There is a way to enforce permissions based on field data? And return only data filtered on the user permissions?

Answer 1

Yes; row-level security can define this declaratively. Something like:

create policy audi_bmw on carmodel for select using (
  id in (1, 3)
);

I'm guessing this permission comes from another table though; so it might be more like:

create policy audi_bmw on carmodel for select using (
  id in (
    select car_model_id
    from user_carmodel_permissions
    where user_id = current_user_id()
  )
);

assuming you already have a current_user_id function, something like:

create function current_user_id() returns int as $$
  select nullif(current_setting('jwt.claims.user_id', true), '')::int;
$$ language sql stable;

Check out our row level security cheatsheet.