Unable to delete file with storage.delete() using authorization header about hasura-storage

[dbarrosop]

Works for me:

curl -v -X DELETE http://localhost:8000/v1/storage/files/55af1e60-0f28-454e-885e-ea6aab2bb288 -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NTMyODY4NDMsImh0dHBzOi8vaGFzdXJhLmlvL2p3dC9jbGFpbXMiOnsieC1oYXN1cmEtYWxsb3dlZC1yb2xlcyI6WyJhZG1pbiJdLCJ4LWhhc3VyYS1kZWZhdWx0LXJvbGUiOiJhZG1pbiIsIngtaGFzdXJhLXVzZXItaWQiOiJhYjViYTU4ZS05MzJhLTQwZGMtODdlOC03MzM5OTg3OTRlYzIiLCJ4LWhhc3VyYS11c2VyLWlzQW5vbnltb3VzIjoiZmFsc2UifSwiaWF0IjoxNjUzMjg1OTQzLCJpc3MiOiJoYXN1cmEtYXV0aCIsInN1YiI6ImFiNWJhNThlLTkzMmEtNDBkYy04N2U4LTczMzk5ODc5NGVjMiJ9.TtzjqVYT0pWoi8BiZRRY_6z-W9lZ7u8j2s4stpI3l4s'
*   Trying 127.0.0.1:8000...
* Connected to localhost (127.0.0.1) port 8000 (#0)
> DELETE /v1/storage/files/55af1e60-0f28-454e-885e-ea6aab2bb288 HTTP/1.1
> Host: localhost:8000
> User-Agent: curl/7.79.1
> Accept: */*
> Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2NTMyODY4NDMsImh0dHBzOi8vaGFzdXJhLmlvL2p3dC9jbGFpbXMiOnsieC1oYXN1cmEtYWxsb3dlZC1yb2xlcyI6WyJhZG1pbiJdLCJ4LWhhc3VyYS1kZWZhdWx0LXJvbGUiOiJhZG1pbiIsIngtaGFzdXJhLXVzZXItaWQiOiJhYjViYTU4ZS05MzJhLTQwZGMtODdlOC03MzM5OTg3OTRlYzIiLCJ4LWhhc3VyYS11c2VyLWlzQW5vbnltb3VzIjoiZmFsc2UifSwiaWF0IjoxNjUzMjg1OTQzLCJpc3MiOiJoYXN1cmEtYXV0aCIsInN1YiI6ImFiNWJhNThlLTkzMmEtNDBkYy04N2U4LTczMzk5ODc5NGVjMiJ9.TtzjqVYT0pWoi8BiZRRY_6z-W9lZ7u8j2s4stpI3l4s
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 204 No Content
< Content-Type: application/json; charset=utf-8
< Date: Mon, 23 May 2022 06:05:47 GMT
<
* Connection #0 to host localhost left intact

I suspect your token may not be correct, most likely your token isn't granting you the role you think it is granting you. Could you:

1. Decode the token and share the payload? You can use this website to decode it: https://www.jstoolset.com/jwt
2. Share the logs for hasura? (docker logs nhost-hasura)

Thanks

[eekrain]

Yo, sorry for late reply. This is my decoded jwt that i got from nhost.auth.getAccessToken():

{ "header":{ "alg":"HS256" }, "payload":{ "https://hasura.io/jwt/claims":{ "x-hasura-allowed-roles":[ "user", "me", "administrator" ], "x-hasura-default-role":"administrator", "x-hasura-user-id":"0e09fe10-7d69-48ba-90be-771fa569e52d", "x-hasura-user-is-anonymous":"false" }, "sub":"0e09fe10-7d69-48ba-90be-771fa569e52d", "iss":"hasura-auth", "iat":1654191822, "exp":1654192722 } }

As you can see, on the allowed roles this token belongs to administrator role, i even made it as the default role.

And then here is the logs from hasura graphql engine :
{"type":"http-log","timestamp":"2022-06-02T17:54:37.120+0000","level":"error","detail":{"operation":{"user_vars":{"x-hasura-role":"administrator","x-hasura-user-is-anonymous":"false","x-hasura-user-id":"0e09fe10-7d69-48ba-90be-771fa569e52d"},"error":{"path":"$.selectionSet.deleteFile.selectionSet.bucket","error":"field \"bucket\" not found in type: 'files'","code":"validation-failed"},"request_id":"0f665d3b-d481-4d77-9a29-4daad744647d","response_size":137,"query":{"variables":{"id":"87d394e0-8446-477f-8837-8b8696d3a065"},"query":"mutation ($id:uuid!){deleteFile(id: $id){id,name,size,bucketId,etag,createdAt,updatedAt,isUploaded,mimeType,uploadedByUserId,bucket{id,minUploadFileSize,maxUploadFileSize,presignedUrlsEnabled,downloadExpiration,createdAt,updatedAt,cacheControl}}}"},"request_mode":"error"},"request_id":"0f665d3b-d481-4d77-9a29-4daad744647d","http_info":{"status":200,"http_version":"HTTP/1.1","url":"/v1/graphql","ip":"127.0.0.1","method":"POST","content_encoding":null}}}

So the error was it failed when requesting bucket table, and im only giving permission on delete in storage.bucket table. Here is the permission on bucket:

After i gave the administrator role on select permission, it succeeded when deleting the file. I dont know the select permission on bucket table is needed when u want to delete some file, it's not in the docs, please put it in the docs. Thanks for the help, i think u can close this issue.

[dbarrosop]

Ok, that issue was fixed and released. Can you try with 0.2.1? If you are using our cloud service you should have it already, similarly, if you are using our latest cli, you should have it as well (unless you are overriding the version).

For reference, #87

[dbarrosop]

I am closing this one, if this is still an issue don't hesitate to reopen