Example 4 - With FaunaDB Authentication

[Vadorequest]

The canvas dataset is stored in FaunaDB.
Changes to the canvas are real-time and shared with everyone when not authenticated.
Changes to the canvas are real-time and shared with yourself when being authenticated. (open 2 tabs to see it in action)
Users can create an account and login using Magic Link, they'll automatically load their own document.

This branch is meant to be kept as an example. It is automatically deployed on Vercel, which allows us to have a dedicated deployment for this variant.

Demo: https://poc-nextjs-reaflow-git-with-faunadb-auth-ambroise-dhenain.vercel.app/

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/ambroise-dhenain/poc-nextjs-reaflow/ERoxbkr8NmfXBkeu2HbmB9mjYLze
✅ Preview: https://poc-nextjs-reaflow-git-with-faunadb-auth-ambroise-dhenain.vercel.app

[marrony]

here you are mixing the legacy permissions sub-system and bellow you are using the new ABAC roles, we don't recommend mixing both systems.

[Vadorequest]

Thanks for your feedback, I wasn't aware I was mixing both systems.

I only did that because without it the index doesn't work, but I don't really understand what I should do instead using ABAC. I basically followed what someone else told me to and it worked well.

I understand anything that's not using a Query is using the old permissions sub-system? Or am I mistaken? (how do you tell what's ABAC and what isn't?)

[marrony]

ABAC will be evaluated every time you use a token, all roles membership will be evaluated to detect which one contains a resource collection of the same type of your instance in the token, after this the privileges will be evaluated, I saw you have a Editor role that contains the collection Users on membership.

[Vadorequest]

Okay, what I want is to allow authenticated users to use the index canvas_by_owner. It's used there:

rwa-faunadb-reaflow-nextjs-magic/src/utils/canvasStream.ts

Lines 155 to 160 in 7625102

	const findUserCanvas = Paginate(
	Match(
	Index('canvas_by_owner'),
	Ref(Collection('Users'), user.id),
	),
	);

Only the editors have the right to use the canvas_by_owner index.

I don't really understand what I should change, I don't see any issue with the current setup, it seems secure to me. 🤔

[marrony]

you are actually deleting something that doesn't exist, you are calling Delete on the "false" branch

[Vadorequest]

I added this from https://github.com/fauna-brecht/faunadb-auth-skeleton-frontend/blob/default/fauna-queries/helpers/fql.js#L14-L16 but I didn't use it myself.

I understand it should rather be:

function DeleteIfExists(ref) {
  return If(Exists(ref), Delete(ref), false)
}

[marrony]

If you create tokens, you must pass an instance ref, given this, that role will be discarded because it doesn't contains any membership predicate.

Membership-less roles are meant to be used with JWT tokens (see Access Providers)

[Vadorequest]

I guess I used the wrong wording, the Public role isn't using a token, but a key.