hasura / hasura/graphql-engine

Context based Roles

Open
#4,650 0 comments 0 reactions 0 assignees View on GitHub
a/authz c/server k/ideas
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

Right now, the permissions system works on roles which are part of the JWT, and custom conditions which you can set per role. This system is flexible enough to provide a basic operation permissions and field selection for each role.

However, we know that conditional based fields for setting/selection is not possible with one role.

To tackle this, I am proposing context based role feature, where the role itself is a set of the session-role from JWT and context information, for example that a user is the author of a blog-post.

The idea here is to be able to create `context-roles` for each specific data table.
Lets consider the the blog-post-author example:

1. On the blogpost data page we have a new option: "Define context role"
2. If we click on It, a Form opens, where we can define the `name` and a custom `check`
3. For the `blog-post-author` example we can define `name: author` and the check `author_id: {_eq: "x-hasura-user-id"}`,
4. Thats it, we have a new (computed) role where we can apply other options and settings like for any other role.
5. To be able to make a query with the `author` role we could use headers or query arguments like:

```
blog_posts_by_pk(pk_columns: {id: 123}, _as: "author") {
id
draft_state
}
```

===

I think this solution is elegant, because you can define domain specific names for your context-roles based on the actual entity context. For example in a conference app for a `speech` the roles would be `speaker`, `organizator`, `attendee`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.