https://www.prisma.io/ logo
Join Slack
Powered by
The file api (<https://www.graph.cool/docs/referen...
# prisma-whats-new
c
The file api (https://www.graph.cool/docs/reference/graphql-api/file-management-eer4wiang0/#uploading-files) is super cool, but if I'm reading this correctly I could hijack anyone's GraphQL account and use it as a free S3 account if I just have their 
project_id
? ie: I can post a 300MB file to your 
<https://api.graph.cool/file/v1/__PROJECT_ID__>
and get back a public URL to that file, and I can do that until you get your next graph.cool bill and delete my files
f
If they don't restrict their api with a bearer token .. yes .. always use a token kids
👍 1
c
Is that a configuration I'm supposed to do as a graph.cool user?
f
You enable permissions on your CRUD operations
c
yeah, but: "File uploads using the File API are not governed by the permissions on the File type. As such, everyone can upload files to your project. Please reach out in the Forum or Slack if you have any questions about this." https://www.graph.cool/docs/reference/graphql-api/file-management-eer4wiang0
so I don't think authorization or authentication tokens can limit file uploads?
f
You can, you have to set it via the Schema as a UserRole
Copy code
enum UserRole {
  EDITOR,
  MODERATOR,
  ADMIN
}
If you haven't ejected the project to CLI , you can edit the roles permissions in the gui
We use granular roles in React
Copy code
isOwner(
type: String!
nodeId: ID!
): isOwnerPayload
it includes subfields like isPublished, isLEVEL, isRole
c
okay sure, but what am I adding a permission for? 
operation: File.upload
?
f
Copy code
type File @model {
  contentType: String!
  createdAt: DateTime!
  id: ID! @isUnique
  name: String!
  secret: String! @isUnique
  size: Int!
  updatedAt: DateTime!
  url: String! @isUnique
}
If you dont' use Authentication required for User .. you can use a secret like this ^^
This is Prisma specific, but the same aws-sdk can be used in your script - https://medium.com/@maticzavadlal/graphcool-1-0-examples-series-file-api-3b16b4b8785f
c
That's the File model I'm using, and when I pretend to be a malicious user that only knows my app id I get the secret back in my curl request:
Copy code
curl -X POST '<https://api.graph.cool/file/v1/cjf9wgjgy0fad01911uz14rrs>' -F "data=@example.png;filename=test.png"                                          14:22:58

{
  "secret": "cjfbhuxtx09sb0146ryq88sq8",
  "name": "test.png",
  "size": 70991,
  "url": "<https://files.graph.cool/cjf9wgjgy0fad01911uz14rrs/cjfbhuxtx09sb0146ryq88sq8>",
  "id": "cjfbhuyn709sc0146rj6vwa4h",
  "contentType": "image/png"
}
and I don't have any permissions listed in graphcool.yml, which should mean that everything involving a File is unallowed by default, right?
f
Its the opposite.. everything is allowed to everyone by default
Which is why you include an app secret in the Type if you dont lock the permissions
c
...no? "In general, permissions follow a whitelist approach: no operation is permitted unless explicitely allowed" https://www.graph.cool/docs/reference/auth/authorization/overview-iegoo0heez
f
I wouldn't follow everything the docs say, try your own overhead operations. Literally spelling something differently will give you different results #opensource
This is what a default project looks like from the console view permissions wise:

https://s3-us-west-2.amazonaws.com/vyrl-assets/permissions.png▾

c
I updated my permissions to only allow authenticated actions on the File object for create, read, update, and delete (more strict than in your screenshot):
Copy code
- operation:        File.create
  authenticated:    true
- operation:        File.read
  authenticated:    true
- operation:        File.update
  authenticated:    true
- operation:        File.delete
  authenticated:    true
And I can still do this:
Copy code
$ curl -X POST '<https://api.graph.cool/file/v1/cjf9wgjgy0fad01911uz14rrs>' -F "data=@example.png;filename=test.png"
{
  "secret": "cjfbrdm8009xo014678l1snem",
  "name": "test.png",
  "size": 70991,
  "url": "<https://files.graph.cool/cjf9wgjgy0fad01911uz14rrs/cjfbrdm8009xo014678l1snem>",
  "id": "cjfbrdn3n09xp01469vf6vro8",
  "contentType": "image/png"
}
f
More strict? .. the screenshot shows default of almost no restriction
2 Views
Open in Slack
PreviousNext
Powered by