Here is the middleware that im using, so instead o...
# spicedb
j
Here is the middleware that im using, so instead of doing a check, i should just add the entity to the dataloader right? That is what I'm understanding
Copy code
/*Nexus query middleware for SpiceDB permissions */

function withPermissions(options: MiddlewareOptions) {
  return async function (root, args, ctx, info, next) {
    if (skipCheck()) return next(root, args, ctx, info);

    const result = await next(root, args, ctx, info);
    const nodes = result.nodes ?? (result.value ? [result.value] : []);
    if (!nodes.length) return result;

    const { spicedbPool, neighbour } = ctx.state;
    const resourceKey = options.overrides?.resource ?? extractResourceKey(result.info);
    
    if (!resourceKey || !neighbour || !(spicedbPool instanceof SpiceDBPool)) return result;

    const spicedb = spicedbPool.getClient();
    const mainPermission = options.overrides?.permission ?? "view";
    const fallbackPermission = options.overrides?.fallback?.permission ?? "partial_view";

    const resultsByResourceId = await spicedb.groupCheck({
      subject: { id: neighbour.id, type: "neighbour" },
      resources: nodes.map(node => ({ type: resourceKey, id: node.id })),
      permissions: [mainPermission, fallbackPermission],
    });

    const authorizedNodes = nodes.filter(node =>
      resultsByResourceId[node.id]?.passed.has(mainPermission) ||
      resultsByResourceId[node.id]?.passed.has(fallbackPermission)
    );

    return result.nodes ? { ...result, nodes: authorizedNodes } : { ...result, value: authorizedNodes[0] ?? null };
  };
}
6 Views