hasura / hasura/graphql-engine

Column preset restricts column access in mutation for configured role

Open
#4,146 1 comment 0 reactions 0 assignees View on GitHub
a/authz c/server k/ideas
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

**Background:** The [docs ](https://hasura.io/docs/1.0/graphql/manual/schema/default-values/column-presets.html) say:
> If a column has a preset defined for a given role, access to the column for mutations will be restricted for users with that role.

**Problem:** The client must make sure that, depending on the role and its permissions in hasura, the column with a preset defined must not be delivered with the mutation (not even as `undefined`). This makes the client tightly coupled to the hasura permissions schema.

**Idea:** Instead of restricting mutation access for columns with column presets, ignore the value delivered by client for these columns. This way the clients can be more versatile.

**Playground:** https://warm-sierra-90192.herokuapp.com/console/api-explorer

Contributor guide

Open the contributing guide

Research direction

Start with the linked column-presets documentation and reproduce the behavior in the Playground. Trace how a mutation handles a client-supplied value for a column with a role-specific preset. Done means the preset column's client value is ignored rather than rejected, while the preset behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authorization
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.