-
-
Notifications
You must be signed in to change notification settings - Fork 128
Description
Turns out it was implemented in v2 the .check method
https://zenstack.dev/docs/2.x/guides/check-permission
Is your feature request related to a problem? Please describe.
Yes my schema defines permissions per row, some rows are editable, deleteable etc by a certain user, only my frontend is not aware of this. Currenly im mimicking my policies in some sort of permission layer to figure out if i need to show or hide a edit button in my admin area.
Describe the solution you'd like
I would like to have a similar solution as in Ruby's best authorisation plugin CanCanCan as explained here: https://github.com/CanCanCommunity/cancancan/blob/develop/docs/define_check_abilities.md
# check if a user is allowed to create a model (name is Article)
can? :create, Article, user: user
# or update a specific articel instance
@article = Article.find(params[:id])
can? :update, @article, user: userLets switch back to zensteack, i would like something like this, lets take the user policy
taken from https://zenstack.dev/docs/orm/access-control/write-policies
model User {
id Int @id @default(autoincrement())
email String @unique
posts Post[]
// open to signup, profiles are public
@@allow('create,read', true)
// the user himself has full access
@@allow('all', auth().id == id)
}This could be a solution?
const userDb = authDb.$setAuth(user);
// something like this? to see if a policiy is applicable, so that i could show a [create] button or whatever
userDb.user.isAllowedTo('create')
// than for a row based
userDb.user.findUnique({where: {id: auth().id}}).isAllowedTo('update')Im searching for this isAllowedTo or in CanCanCan the can? method.
Describe alternatives you've considered
No ive got my Ai going over all my policies and it writes a permission.ts and this a horrible developmentflow.