Policy Enforcer

Hey friends

In my last project that I did it with hasura, I had a lot of challenges in Authorization and Access Controlling limitations in hasura
Assume we have an access rule, which the Documents resource is only available only at 9:00 PM, what is the solution in hasura?

There is no way to do this and no way for handling any other advanced Access Rules like IP based, or MAC based or etc

I think in this situation there is a need for an external service like Access Enforcer, handling access controls using roles in hasura has a lot of limitations, and also the concept of Authorization is not directly related to CRUD endpoints

I think the correct way of handling access rules in hasura is using webhooks, I solved my last project problem by creating an endpoint which is responsible for controlling the access on hasura resources and returning the Allow or Deny as X-Hasura-Default-Role

The first challenge that I did was the filtering, sometimes some user does not have access to the entire resource, so I define more returning types like Allow-SelfCreateds and Allow-Public

The second challenge that I could not complete was about the relations, sometimes a user request's a resource like Document and a related resource like Tags in one query, in this situation hasura will send one request to webhook with entire query as string, now the 'Access Enforcer' first must extract the requested resources from query string, then it can decide to allow or not,
In the current state hasura cannot have multiple default roles for resources, for example the user can access All the tags but Self created documents only, which hasura cannot handle multiple default roles per resource