hasura / hasura/graphql-engine
Missing query_root when no permissions are set
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
My use case is simply based on having a single mutation for unauthenticated users which basically is an action to signUp/signIn. There is no access to any data.
When running an introspection query in such a case, the `query_root` does not exist at all which is trouble for some external tools.
By spec, the query_root should be always defined even if empty.
http://spec.graphql.org/draft/#sec-Root-Operation-Types

Viable, workaround seems to set permissions to unauthenticated role without any fields. I've verified that GraphQL Playground can handle that well. However, tools like `graphql-code-generator` still have a problem with that for some reason.
> "query_root" defined in resolvers, but not in schema
Contributor guide
Research direction
Start with the introspection query and the schema/resolver handling for query_root, comparing the generated schema with the GraphQL root-operation specification. Done means introspection exposes an empty query_root when no permissions are set, while the unauthenticated mutation remains available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100