Get user_info inside of collection

[stefanak-michal]

Hi.

I would like to know if it's possible to load user_info inside of procedure which runs at specific collection? Because I would like to use user_id from user_info.

I have this procedure in @:stuff:

list_todos || {
	user_id = user_info().load().user_id;
	.todos
		.filter(|t| t.user_id == user_id);
}

How can I identify (use) logged user in the whole ThingsDB logic I'll implement?

I don't want to return user_id to client and force client to send it with each request to ThingsDB.

[joente]

This is not possible right now, but not that hard to make. I don't see any harm to make user_info() available to collection scopes, especially without arguments for the current user info.

[joente]

@stefanak-michal , I've created this pr: #386

[stefanak-michal]

I didn't expect this response 😃

[joente]

Do you think a function user_id() (or something similar) would be useful? This function would simply return with the current user Id?

I understand that its possible to create a procedure doing the same, but a dedicated function would be more efficient as it does not require to retrieve all user info, load it into ThingsDB, and then just extract the user Id. I'm just not sure if it's worth creating it.

[stefanak-michal]

I don't think it is required. Maybe in future if there will be more interest into it.

[stefanak-michal]

Let me tell you some history how I encountered this problem. I'm working on demo to showcase js driver directly connecting to ThingsDB. It's just ToDo app with user accounts. As you propably guessed already, user accounts are a little bit problem to deal with. I noticed this disccusion #364 which would be nice. But without it and without any other backend layer I have to use ThingsDB to manage that. (for a moment I was thinking about using auth0 and just do some curl from ThingsDB, but I didn't found out if it's possible, it would be nice to have this feature).

Therefore I have one specific user account with CHANGE|GRANT|RUN on @t. This account is used for users registration. With registration new ThingsDB user is created (with CHANGE|RUN on @:stuff). For socket auth method when user log in I use his credentials but immediatelly I generate token for him and return it. Afterwards only token is used while loged in.

But this approach also required to add permission CHANGE|GRANT on @t for that user (because of new_token method). I'm thinking how to avoid adding these permissions. I was thinking to let the user call socket method auth with his credentials. Afterwards call some procedure and that will return some random value to client. Then client will call ThingsDB again, but this time with that public auth admin special account, send this random value back to some procedure and that procedure will generate token for the user and return it. But I don't know how to store this random value in ThingsDB so it would be accessible to both. Because user would have permission only for @:stuff and auth admin has only over @t.

Maybe I'm just thinking about it all wrong. 🤔

[joente]

With the ThingsDB module it is possible to connect scopes. This way you could always "talk" to the collection scope and execute procedures in the @t scope (the module has its own access account so the "user" only requires @collection scope access, and the "module-user" only requires @t scope access. Maybe that helps? (The book example does it the other way around, but the idea is similar: https://book.thingsdb.io/#chapter-13-2-3)

[stefanak-michal]

Thanks for referencing me. I'll look into it. Also I see the previous chapter talks about module for http requests, another thing I was thinking about how to achieve. Maybe I should reread the book one more time. 😊