I want to run the following query: Verification.firstWhere(.email == "john@doecom")!.delete()
It’s a read
followed by a delete
. The challenge is now, that Verification is a quite sensitive collection, as it stores also verification tokens, so I don’t want that a user can read it’s content (And as my current knowledge field permissions are not yet existing in Fauna). But I want to give the user the chance to delete a verification that is associated with his identity.
The catch: I would like to work with standard query syntax Verification.firstWhere(.email == "john@doe.com")!.delete()
in combination with ABAC rather then continuously introducing custom functions. So my question is, can I achieve somehow a conditional read that is only allowed if it’s directly followed by a delete?
Current code snippet:
role role_user {
// [...]
// Only delete permission is not enough as the document needs to be first identified with `read` permissions to get deleted.
privileges Verification {
delete {
predicate ((doc) => {
Query.identity()!.activeVerifications.includes(doc.email)
})
}
}
membership User {
predicate ( (doc) => isCalledWithAccessToken() )
}
}
collection Verification {
email: String
otp: String // This is the high sensitive field that should not be exposed to the user via `read` permission.
user: Ref<User>?
// [...]
}