jhos
01/31/2025, 5:48 PM/*Nexus query middleware for SpiceDB permissions */
function withPermissions(options: MiddlewareOptions) {
return async function (root, args, ctx, info, next) {
if (skipCheck()) return next(root, args, ctx, info);
const result = await next(root, args, ctx, info);
const nodes = result.nodes ?? (result.value ? [result.value] : []);
if (!nodes.length) return result;
const { spicedbPool, neighbour } = ctx.state;
const resourceKey = options.overrides?.resource ?? extractResourceKey(result.info);
if (!resourceKey || !neighbour || !(spicedbPool instanceof SpiceDBPool)) return result;
const spicedb = spicedbPool.getClient();
const mainPermission = options.overrides?.permission ?? "view";
const fallbackPermission = options.overrides?.fallback?.permission ?? "partial_view";
const resultsByResourceId = await spicedb.groupCheck({
subject: { id: neighbour.id, type: "neighbour" },
resources: nodes.map(node => ({ type: resourceKey, id: node.id })),
permissions: [mainPermission, fallbackPermission],
});
const authorizedNodes = nodes.filter(node =>
resultsByResourceId[node.id]?.passed.has(mainPermission) ||
resultsByResourceId[node.id]?.passed.has(fallbackPermission)
);
return result.nodes ? { ...result, nodes: authorizedNodes } : { ...result, value: authorizedNodes[0] ?? null };
};
}