hasura / hasura/graphql-engine

Undocumented Limitation: Remote Schema Session Arguments for Non-Singletons

Open
#10,083 0 comments 0 reactions 0 assignees View on GitHub
k/bug t/gql-services
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

I'm not sure if this is actually a feature request, or a bug report but here goes:

**Server Version:** v2.26.0
**Environment:** OSS

### Current behaviour?

When trying to save permissions for a remote schema, I get the error:

`Session arguments can only be set for singleton values`

This is when I attempt to set the `where` clause to check if a field's value is `_in` the Hasura session variable; specifically if a field I call `group` is in my custom `x-hasura-allowed-groups` session variable.

Using normal table permissions, it works fine, however, I'm unable to set it for remote schema permissions. Is there a workaround to check for values in arrays for remote schemas, or is this a bug?

It doesn't seem to be listed in the documentation:
- https://hasura.io/docs/latest/auth/authorization/roles-variables/#type-formats-of-session-variables
- https://hasura.io/docs/latest/remote-schemas/auth/remote-schema-permissions/

### Expected behaviour?

The remote schema permission is able to be saved when attempting to use a session variable in non-singleton (array) operators.

### How to reproduce the issue?

1. In the Hasura console, connect to a remote schema
2. Creat a permission for any role and set it to check if a value in a query is `_in` a session variable (x-hasura-*).
3. Attempt to `save` the permission

### Screenshots

![image](https://github.com/hasura/graphql-engine/assets/5701052/1d24384f-4edc-4346-b97a-bb439eaa7ad9)

### Log from Hasura Console

```
{"detail":{"http_info":{"content_encoding":null,"http_version":"HTTP/1.1","ip":"192.168.65.1","method":"POST","status":400,"url":"/v1/metadata"},"operation":{"error":{"code":"validation-failed","error":"validation for the given role-based schema failed because illegal preset value at \"_in\". Session arguments can only be set for singleton values","path":"$.args[1].args"},"query":{"type":"bulk"},"request_id":"783d692e-45be-4143-902e-0024dc8f4e10","request_mode":"error","response_size":208,"uncompressed_response_size":208,"user_vars":{"x-hasura-role":"admin"}},"request_id":"783d692e-45be-4143-902e-0024dc8f4e10"},"level":"error","timestamp":"2024-01-04T03:22:38.820+0000","type":"http-log"}
```

### Any possible solutions/workarounds you're aware of?

No, however, the goal is to be able to check if a value is in an array session variable for remote schema permissions.

### Keywords

- remote schema
- permissions
- singleton
- non-singleton
- session arguments
- array
- _in

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.