hasura / hasura/graphql-engine

[ Question / Feature Request ] - Is there a technical reason we can't have different column permissions on each role

Open
#6,817 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

Have many situations where I'm trying to manage PII user data.

Can we please get column permissions, that are more flexible than just true/false, I know you can create a view but this isn't really a good solution because I can't foreign key to my view, and again because column permissions are binary (on/off) in my view, if I need a different column available under different circumstances, again its another view or custom backend simply to just change permissions.

This has been one of the only pain points with Hasura for me is the permissions system is flexible for everything but columns.

I would love to have a base permissions set, say X equals true **or** Y equals true.

Then permissions on columns say column "A" is available when Z equals true.

The resulting query would be.... (X equals true OR y equals true ) AND Z equals true, when column "A" is in the query.

Feel like this works for all possible combinations.

Contributor guide

Open the contributing guide

Research direction

No file, test, or entry point is identified. Start by reviewing Hasura's existing role and column-permission behavior, including the view and foreign-key limitations described here. Done would require a decided design and support for the proposed combined role and per-column conditions.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
authorization, database
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.