FQL v4 will be decommissioned on June 30, 2025. Ensure that you complete your migration from FQL v4 to FQL v10 by that date.

Fauna accounts created after August 21, 2024 must use FQL v10. These accounts will not be able to run FQL v4 queries or access the v4 Dashboard.

For more details, see the v4 EOL announcement and migration guide. Contact support@fauna.com with any questions.

Delegates

A document may delegate access on its behalf to other documents by adding the other documents' References to its delegates list. Any tokens belonging to a member of delegates are granted access as though they were tokens belonging to the delegating document.

Example

For example, if a user (with document ID 1) has read access to the "spells" collection, but another user (with document ID 2) does not, the first user may grant access via delegation to the second user with the following query:

client.query(
  q.Update(
    q.Ref(q.Collection('users'), 1),
    { delegates: [q.Ref(q.Collection('users'), 2)] },
  )
)
.then((ret) => console.log(ret))
.catch((err) => console.error(
  'Error: [%s] %s: %s',
  err.name,
  err.message,
  err.errors()[0].description,
))

{
  ref: Ref(Collection("users"), "1"),
  ts: 1621374020750000,
  data: { name: 'Alice Crypto', email: 'alice@site.example.com' },
  delegates: [ Ref(Collection("users"), "2") ]
}

result = client.query(
  q.update(
    q.ref(q.collection("users"), 1),
    {"delegates": [q.ref(q.collection("users"), 2)]}
  )
)
print(result)

{'ref': Ref(id=1, collection=Ref(id=users, collection=Ref(id=collections))), 'ts': 1621374021070000, 'data': {'name': 'Alice Crypto', 'email': 'alice@site.example.com'}, 'delegates': [Ref(id=2, collection=Ref(id=users, collection=Ref(id=collections)))]}

result, err := client.Query(
	f.Update(
		f.Ref(f.Collection("users"), "1"),
		f.Obj{"delegates": f.Arr{f.Ref(f.Collection("users"), "2")}},
	))

if err != nil {
	fmt.Fprintln(os.Stderr, err)
} else {
	fmt.Println(result)

map[data:map[email:alice@site.example.com name:Alice Crypto] delegates:[{2 0xc000109d40 0xc000109d40 <nil>}] ref:{1 0xc000109b60 0xc000109b60 <nil>} ts:1621374015010000]

try
{
    Value result = await client.Query(
        Update(
            Ref(Collection("users"), 1),
            Obj("delegates", Arr(Ref(Collection("users"), 2)))
        )
    );
    Console.WriteLine(result);
}
catch (Exception e)
{
    Console.WriteLine($"ERROR: {e.Message}");
}

ObjectV(ref: RefV(id = "1", collection = RefV(id = "users", collection = RefV(id = "collections"))),ts: LongV(1621374013780000),data: ObjectV(name: StringV(Alice Crypto),email: StringV(alice@site.example.com)),delegates: Arr(RefV(id = "2", collection = RefV(id = "users", collection = RefV(id = "collections")))))

System.out.println(
    client.query(
        Update(
            Ref(Collection(Value("users")), Value(1)),
            Obj("delegates", Arr(Ref(Collection(Value("users")), Value(2))))
        )
    ).get());

{ref: ref(id = "1", collection = ref(id = "users", collection = ref(id = "collections"))), ts: 1621374020240000, data: {name: "Alice Crypto", email: "alice@site.example.com"}, delegates: [ref(id = "2", collection = ref(id = "users", collection = ref(id = "collections")))]}

Update(
  Ref(Collection('users'), 1),
  { delegates: [Ref(Collection('users'), 2)] },
)

{
  ref: Ref(Collection("users"), "1"),
  ts: 1624310593770000,
  data: { name: 'Alice Crypto', email: 'alice@site.example.com' },
  delegates: [ Ref(Collection("users"), "2") ]
}

Query metrics:

bytesIn: 122
bytesOut: 320
computeOps: 1
readOps: 0
writeOps: 1
readBytes: 186
writeBytes: 142
queryTime: 8ms
retries: 0

Now, when the second user attempts to read from the "spells" collection, they are granted the same level of access as the first user.

Delegates are not transitive — in the example above, the second user may not delegate the first user’s permissions to another user.

Is this article helpful?

Tell Fauna how the article can be improved:
Visit Fauna's forums or email docs@fauna.com

Thank you for your feedback!

Delegates

Example

Related