hasura / hasura/graphql-engine
Context based Roles
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
Right now, the permissions system works on roles which are part of the JWT, and custom conditions which you can set per role. This system is flexible enough to provide a basic operation permissions and field selection for each role.
However, we know that conditional based fields for setting/selection is not possible with one role.
To tackle this, I am proposing context based role feature, where the role itself is a set of the session-role from JWT and context information, for example that a user is the author of a blog-post.
The idea here is to be able to create `context-roles` for each specific data table.
Lets consider the the blog-post-author example:
1. On the blogpost data page we have a new option: "Define context role"
2. If we click on It, a Form opens, where we can define the `name` and a custom `check`
3. For the `blog-post-author` example we can define `name: author` and the check `author_id: {_eq: "x-hasura-user-id"}`,
4. Thats it, we have a new (computed) role where we can apply other options and settings like for any other role.
5. To be able to make a query with the `author` role we could use headers or query arguments like:
```
blog_posts_by_pk(pk_columns: {id: 123}, _as: "author") {
id
draft_state
}
```
===
I think this solution is elegant, because you can define domain specific names for your context-roles based on the actual entity context. For example in a conference app for a `speech` the roles would be `speaker`, `organizator`, `attendee`
Contributor guide
Assessment
This issue has not been assessed yet.