hasura / hasura/graphql-engine

Relay API has does not work with allow-list

Open
#10,091 0 comments 0 reactions 0 assignees View on GitHub
c/relay c/server k/bug v2
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: 2.36.1
CLI Version (for CLI related issue): 2.36.1

### Environment

OSS

### What is the current behaviour?

when you try to add an relay query, it says query not found

### What is the expected behaviour?

adds the relay connection as an allowed query

### How to reproduce the issue?

1. turn on relay
2. turn on allow list
3. add query -> get error

### Screenshots or Screencast

response from metadata endpoint

```json
{
"error": "cannot continue due to newly found inconsistent metadata",
"path": "$.args[0].args",
"code": "unexpected",
"internal": [
{
"definition": {
"name": "MyQuery",
"query": "query MyQuery {\n xyz_connection {\n edges {\n node {\n id\n }\n }\n }\n}"
},
"name": "query_collections MyQuery in allowed-queries",
"reason": "Inconsistent object: In query collection \"allowed-queries\" the query \"MyQuery\" is invalid with the following error(s): \"$.xyz_connection: field 'xyz_connection' not found in object 'query_root'\". This query is in allowlist.",
"type": "query_collections"
}
]
}
```

### Please provide any traces or logs that could help here.

see above

### Any possible solutions/workarounds you're aware of?

don't use relay if you want allow list

### Keywords

relay graphql API does not work with allow list

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with Relay and the allow-list enabled, using the MyQuery example and the metadata endpoint response provided. Trace why xyz_connection is missing when the query is added to the allowed-queries collection; done means Relay queries can be added to the allow-list without a query-not-found or inconsistent-metadata error.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.