hasura / hasura/graphql-engine
Permissions Inheritance (Parent to Child like relationships)
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Is your proposal related to a problem?
I think managing permissions in Hasura is pretty great, but for related tables it can become tedious and open to mistakes. Let's say you have a table 'product' with several related tables:
product
product_files
product_options
product_orders
product_articles
... etc. etc.
With at least the following roles: user, manager, anonymous.
To correctly prevent any of the related tables from being available or not, I have to ensure the permissions match those set in the product itself. If the permissions for the product are changed, I have to then update all of the related tables permissions to match - during which time I could make a mistake and not copy them correctly, miss one of the related tables, or just forget to do the whole process entirely.
### Describe the solution you'd like
When defining the permissions of a related table, I could begin by defining an inherit value in the rules. That would mean that this table automatically checks the other tables permissions for the user's role, before applying any other custom permissions logic.
As an example:
product (set permissions here for roles)
order (set permissions here for roles)
product_file: { inherit: product, type: { _eq: { user_photo } } }
product_order: { inherit: product, inherit: order, status: { _in: [x, y, z] }, etc. etc. }
The implementation of this could simply be that by defining an inheritance, when the metadata is generated it copies those from the parent. Alternatively, at the time of checking the permissions and encountering an 'inherit' rule, it would go to find those rules. The former is probably much easier as it only requires one change (generating the metadata.)
### Describe alternatives you've considered
Using the Permissions Summary, and copying permissions. It works, but I believe it's open to mistakes and this solution will save a lot of time.
Contributor guide
Research direction
The proposal identifies metadata generation and permission checking as possible entry points; compare those paths first. Clarify how inherited permissions combine with custom rules and multiple parents, then verify that related-table roles remain consistent when a parent permission changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100