hasura / hasura/graphql-engine

V2 no longer allows constrained related tables for unauthorised roles

Open
#7,111 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

I used to be able to make a public (unauthorised role) query which involved a related table which had a x-hasura-user-id constraint on it. In V2 it throws an error that it is missing x-hasura-user-id. Previously if the user was not logged in the field would just return empty []. This was extremely handy because it meant I could use one query regardless of whether the user was logged in or not. And it would always return the same set of objects back in the json. Now I need to make 2 different queries and add extra logic because certain objects will now be 'undefined' if the user is not logged in.

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by reproducing the unauthorised V2 query involving a related table with an x-hasura-user-id constraint, then compare it with the previous behavior; done means unauthorised queries return empty arrays instead of failing for the missing session value.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.