Prisma

is it possible, in *prisma 2*, to use permission based authorization?

with that I mean:
a *user* have many *roles*
a *role* has many *permissions*

Hey <@U0145LQHB1Q> :wave:
You can use <https://github.com/maticzav/graphql-shield|GraphQL Shield> where you can directly add permissions in the following manner:
```const permissions = shield({
  Query: {
    frontPage: not(isAuthenticated),
    fruits: and(isAuthenticated, or(isAdmin, isEditor)),
    customers: and(isAuthenticated, isAdmin),
  },
  Mutation: {
    addFruitToBasket: isAuthenticated,
  },
  Fruit: isAuthenticated,
  Customer: isAdmin,
})

const server = new GraphQLServer({
  typeDefs,
  resolvers,
  middlewares: [permissions],
  context: (req) =&gt; ({
    ...req,
    user: getUser(req),
  }),
})```
You can add permission based authorization as a simple resolver.

Hi Ryan, thanks for your answer
the solution you showed me is not flexible enough because you are working with permissions directly, I mean a user has a permission or not

in my case its different, in my case a user have one or many roles

and the roles are like containers that has permissions

so what you can do is to create your own custom role and put the permissions that are available

It's possible to use Shield in this case as well.
You can combine multiple roles and return the conditions based on those. It would be like composing those permissions and getting the final result.