hasura / hasura/graphql-engine
Column preset restricts column access in mutation for configured role
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
**Background:** The [docs ](https://hasura.io/docs/1.0/graphql/manual/schema/default-values/column-presets.html) say:
> If a column has a preset defined for a given role, access to the column for mutations will be restricted for users with that role.
**Problem:** The client must make sure that, depending on the role and its permissions in hasura, the column with a preset defined must not be delivered with the mutation (not even as `undefined`). This makes the client tightly coupled to the hasura permissions schema.
**Idea:** Instead of restricting mutation access for columns with column presets, ignore the value delivered by client for these columns. This way the clients can be more versatile.
**Playground:** https://warm-sierra-90192.herokuapp.com/console/api-explorer
Contributor guide
Research direction
Start with the linked column-presets documentation and reproduce the behavior in the Playground. Trace how a mutation handles a client-supplied value for a column with a role-specific preset. Done means the preset column's client value is ignored rather than rejected, while the preset behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, authorization
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100