hasura / hasura/graphql-engine

Missing query_root when no permissions are set

Open
#4,460 4 comments 4 reactions 0 assignees View on GitHub
c/server
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

My use case is simply based on having a single mutation for unauthenticated users which basically is an action to signUp/signIn. There is no access to any data.

When running an introspection query in such a case, the `query_root` does not exist at all which is trouble for some external tools.

By spec, the query_root should be always defined even if empty.

http://spec.graphql.org/draft/#sec-Root-Operation-Types

![image](https://user-images.githubusercontent.com/1096340/79603696-1d930400-80ed-11ea-9fc2-cb34497a749a.png)

Viable, workaround seems to set permissions to unauthenticated role without any fields. I've verified that GraphQL Playground can handle that well. However, tools like `graphql-code-generator` still have a problem with that for some reason.

> "query_root" defined in resolvers, but not in schema

Contributor guide

Open the contributing guide

Research direction

Start with the introspection query and the schema/resolver handling for query_root, comparing the generated schema with the GraphQL root-operation specification. Done means introspection exposes an empty query_root when no permissions are set, while the unauthenticated mutation remains available.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.