hasura / hasura/graphql-engine

Permissions Inheritance (Parent to Child like relationships)

Open
#10,052 0 comments 0 reactions 0 assignees View on GitHub
k/enhancement t/gql-services
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?

I think managing permissions in Hasura is pretty great, but for related tables it can become tedious and open to mistakes. Let's say you have a table 'product' with several related tables:

product
product_files
product_options
product_orders
product_articles
... etc. etc.

With at least the following roles: user, manager, anonymous.

To correctly prevent any of the related tables from being available or not, I have to ensure the permissions match those set in the product itself. If the permissions for the product are changed, I have to then update all of the related tables permissions to match - during which time I could make a mistake and not copy them correctly, miss one of the related tables, or just forget to do the whole process entirely.

### Describe the solution you'd like

When defining the permissions of a related table, I could begin by defining an inherit value in the rules. That would mean that this table automatically checks the other tables permissions for the user's role, before applying any other custom permissions logic.

As an example:

product (set permissions here for roles)
order (set permissions here for roles)
product_file: { inherit: product, type: { _eq: { user_photo } } }
product_order: { inherit: product, inherit: order, status: { _in: [x, y, z] }, etc. etc. }

The implementation of this could simply be that by defining an inheritance, when the metadata is generated it copies those from the parent. Alternatively, at the time of checking the permissions and encountering an 'inherit' rule, it would go to find those rules. The former is probably much easier as it only requires one change (generating the metadata.)

### Describe alternatives you've considered

Using the Permissions Summary, and copying permissions. It works, but I believe it's open to mistakes and this solution will save a lot of time.

Contributor guide

Open the contributing guide

Research direction

The proposal identifies metadata generation and permission checking as possible entry points; compare those paths first. Clarify how inherited permissions combine with custom rules and multiple parents, then verify that related-table roles remain consistent when a parent permission changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.