hasura / hasura/graphql-engine
V2 no longer allows constrained related tables for unauthorised roles
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
I used to be able to make a public (unauthorised role) query which involved a related table which had a x-hasura-user-id constraint on it. In V2 it throws an error that it is missing x-hasura-user-id. Previously if the user was not logged in the field would just return empty []. This was extremely handy because it meant I could use one query regardless of whether the user was logged in or not. And it would always return the same set of objects back in the json. Now I need to make 2 different queries and add extra logic because certain objects will now be 'undefined' if the user is not logged in.
Contributor guide
Research direction
The issue names no files, tests, or entry points. Start by reproducing the unauthorised V2 query involving a related table with an x-hasura-user-id constraint, then compare it with the previous behavior; done means unauthorised queries return empty arrays instead of failing for the missing session value.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, authorization
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100