hasura / hasura/graphql-engine
[ Question / Feature Request ] - Is there a technical reason we can't have different column permissions on each role
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
Have many situations where I'm trying to manage PII user data.
Can we please get column permissions, that are more flexible than just true/false, I know you can create a view but this isn't really a good solution because I can't foreign key to my view, and again because column permissions are binary (on/off) in my view, if I need a different column available under different circumstances, again its another view or custom backend simply to just change permissions.
This has been one of the only pain points with Hasura for me is the permissions system is flexible for everything but columns.
I would love to have a base permissions set, say X equals true **or** Y equals true.
Then permissions on columns say column "A" is available when Z equals true.
The resulting query would be.... (X equals true OR y equals true ) AND Z equals true, when column "A" is in the query.
Feel like this works for all possible combinations.
Contributor guide
Research direction
No file, test, or entry point is identified. Start by reviewing Hasura's existing role and column-permission behavior, including the view and foreign-key limitations described here. Done would require a decided design and support for the proposed combined role and per-column conditions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- authorization, database
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100