Hey all!

I have a table group, a table friend and a reference table group_friend, which just holds groupId and friendId. The tables group and friend both have a creatorProfileId that references to which user those two belong.

Now I want a user to be able to only insert rows into the table group_friend if:

• The user is the creator of the group
• There is an entry in the friend table that matches the users profile ID and the friends profile ID

For this I would like to use the values of the input variables (not the session variable) in my permission. Is this even possible? I have read through the FAQ but I only have found a way to reference the root table (group_friend).

This is what I have so far:

  _and: [
    {
      _exists: {
        _table: { name: "friend", schema: "public" },
        _where: {
          _and: [
            { creatorProfileId: { _eq: "X-Hasura-profile-Id" } },
            { friendProfileId: { _ceq: ["$", "friendId"] } }, // <---- here I would like to use the input for `friendId` 
          ],
        },
      },
    },
    {
      _exists: {
        _table: { name: "group", schema: "public" },
        _where: {
          _and: [
            { creatorProfileId: { _eq: "X-Hasura-profile-id" } },
            { id: { _ceq: ["$", "groupId"] } }, // <---- here I would like to use the input for `groupId`
          ],
        },
      },
    },
  ],
}

Maybe I am overthinking this, but of course I do not want users to be able to add users to a group that does not belong to them or to add a user when they have no friend reference with each other. Is this permission setup possible with hasura or do I have to create an edge function for this logic?