Hasura: Change permissions/schema in Hasura on runtime (dynamically) through API call - runtime

Question

I'm trying to change permissions in Hasura on runtime (dynamically) through API call as follows:
curl --location --request POST 'https://hasura-0ccfcde0.nhost.app/v1/query' \
--header 'x-hasura-role: admin' \
--header 'Content-Type: application/json' \
--data-raw '{
"type" : "create_update_permission",
"args" : {
"table" : "customers",
"role" : "users",
"permission" : {
"check" : {
"user_id" : {
"_ne": ""
}
},
"filter" : {
"user_id" : "X-Hasura-User-Id"
},
"set":{
"name":"X-Hasura-User-Id"
},
"columns":["name","email"]
}
}
}'
But it returns with
{
"path": "$.args",
"error": "restricted access : admin only",
"code": "access-denied"
}
I'm following: https://hasura.io/docs/1.0/graphql/core/api-reference/schema-metadata-api/permission.html#create-update-permission
as you can see in the screenshot as well

Answer 1

It's not enough for you to just put admin in the x-hasura-role Header. If you think about it, this would be a huge vulnerability as anyone could issue this request against your backend. You've even shared the endpoint here in your example CURL request!
Instead, you need to pass the x-hasura-admin-secret Header with the value you've configured for your deployment. This value should be extremely guarded as anyone who has access to it has pretty wide open access to Hasura and potentially your entire Database at that point depending on what your Hasura configuration looks like
curl --location --request POST 'https://hasura-0ccfcde0.nhost.app/v1/query' \
--header 'x-hasura-admin-secret: whatever-your-configured-admin-secret-is' \
--header 'Content-Type: application/json' \
--data-raw '{
"type" : "create_update_permission",
"args" : {
"table" : "customers",
"role" : "users",
"permission" : {
"check" : {
"user_id" : {
"_ne": ""
}
},
"filter" : {
"user_id" : "X-Hasura-User-Id"
},
"set":{
"name":"X-Hasura-User-Id"
},
"columns":["name","email"]
}
}
}
Alternatively, making a call with a JWT that is signed with the admin role could also work if you don't want to directly use your Hasura secret. In this case you would set it in the Authorization header with the x-hasura-role: admin claim set