# Owner role on edit

**URL:** <https://community.neo4j.com/t/owner-role-on-edit/10109>\
**Category:** GraphQL & GRANDstack\
**Created:** [September 13, 2019, 7:29pm UTC](https://community.neo4j.com/t/owner-role-on-edit/10109 "2019-09-13T19:29:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![francesco.venica](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/francesco.venica/32/6381_2.png) [@francesco.venica](https://community.neo4j.com/u/francesco.venica)\
**Post date:** [September 13, 2019, 7:29pm UTC](https://community.neo4j.com/t/owner-role-on-edit/10109/1 "2019-09-13T19:29:51Z")

</div>

I've searched around different site but I have not found a solution yet, I have this kind of schema:

```auto
type Friendship @relation(name: "FOLLOW") {
  from: User
  to: User
  timestamp: Int
}

type User {
  uuid: ID!
  email: String
  username: String
  password: String
  friendship: [Friendship]
}

```

or

```auto
type Post {
  uuid: ID!
  text: String
  created: DateTime
  modified: DateTime
  owner: User @relation(name: "HAS_POSTS", direction: "IN")
  reviews: [Review] @relation(name: "HAS_REVIEWS", direction: "OUT")
}

```

and I want to allow the edit of these nodes only by the author of the node, is this possible somehow through neo4j or this is something achievable only through the app acl?

many thanks  
Francesco

---

<div class="post-metadata">

**Author:** ![elaine\_rosenber](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/elaine_rosenber/32/27409_2.png) [@elaine\_rosenber](https://community.neo4j.com/u/elaine_rosenber)\
**Post date:** [September 13, 2019, 9:46pm UTC](https://community.neo4j.com/t/owner-role-on-edit/10109/2 "2019-09-13T21:46:49Z")

</div>

Hello Francesco,

At this time, the application would need to manage what data an end-user can edit.

In our next release of Neo4j (4.0) which will be available early next year, we are adding role-based access control which will make it easier for applications to manage who accesses different part of the graph.

Elaine

---

<div class="post-metadata">

**Author:** ![michael.hunger](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/michael.hunger/32/27377_2.png) [@michael.hunger](https://community.neo4j.com/u/michael.hunger)\
**Post date:** [September 14, 2019, 9:25am UTC](https://community.neo4j.com/t/owner-role-on-edit/10109/3 "2019-09-14T09:25:50Z")

</div>

Have you seen the auth directives blog post from @lyonwj?

> **[Neo4j GraphQL Library - Neo4j GraphQL Library](https://neo4j.com/docs/graphql-manual/current/)**

> **[Authorization In GraphQL Using Custom Schema Directives](https://blog.grandstack.io/authorization-in-graphql-using-custom-schema-directives-eafa6f5b4658)**
>
> With Apollo’s graphql-tools, Auth0 JWTs, and neo4j-graphql.js

---

<div class="post-metadata">

**Author:** ![francesco.venica](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/francesco.venica/32/6381_2.png) [@francesco.venica](https://community.neo4j.com/u/francesco.venica)\
**Post date:** [September 14, 2019, 11:56am UTC](https://community.neo4j.com/t/owner-role-on-edit/10109/4 "2019-09-14T11:56:58Z")

</div>

Hi,

many thnaks both! yes I read it but is a bit different, my problem is not to create roles/scope but to define the ownership of the node and let only the owner edit this node...

---

<div class="post-metadata">

**Author:** ![lyonwj](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/lyonwj/32/27358_2.png) [@lyonwj](https://community.neo4j.com/u/lyonwj)\
**Post date:** [September 16, 2019, 6:10pm UTC](https://community.neo4j.com/t/owner-role-on-edit/10109/5 "2019-09-16T18:10:27Z")

</div>

One option would be to use `@cypher` schema directives to accomplish this. So for example, a mutation to delete all Posts authored by some User would look something like this:

```auto
type Mutation {
  deletePostsByUser(userId: ID!): User @cypher("""
    MATCH (u:User {id: $userId})-[:AUTHORED]->(p:Post)
    DETACH DELETE p
    RETURN u
  """)
}

```

If you are using some sort of auth middleware you can also inject the user specific info (in this case the user id) into the Cypher query. See [Neo4j GraphQL Library - Neo4j GraphQL Library](https://grandstack.io/docs/neo4j-graphql-js-middleware-authorization.html#cypher-parameters-from-context)