hasura / hasura/graphql-engine
Support for granting bulk or full access to Remote Schemas
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Is your proposal related to a problem?
We use the Remote Schema and Actions features of Hasura quite often. The Actions feature supports just mentioning a role name to give it all permissions on that Action.
With Remote Schemas this is not possible, one would need to tick every possible mutation/query/field manually to grant access to all possible operations within that Remote Schema
### Describe the solution you'd like
Would be nice if there is a single checkbox that perhaps corresponds to a configuration option inside of `remote_schemas.yaml` that says grant this role full access to everything this remote schema has to offer.
Also this access remains even when the remote schema changes _(adds new operations)_ so that one doesn't have to go back and update the permissions in Hasura again.
### Describe alternatives you've considered
I am marking everything manually at this stage and checking whether I can automate it using the metadata APIs
#### Update
I did manage to work around this by having a lambda function invoke our Hasura server after it gets deployed to apply permissions. For anyone facing a similar concern here is a basic version _(needs cleanup and some error handling but you get the idea)_ of the code in JavaScript:
```js
const fetch = require('node-fetch')
const {
buildClientSchema,
printSchema,
getIntrospectionQuery,
} = require('graphql/utilities')
function fetchGraphQLSchema(url) {
return fetch(url, {
method: 'POST',
headers: {
Accept: 'application/json',
'Content-Type': 'application/json',
},
body: JSON.stringify({
query: getIntrospectionQuery({
descriptions: false,
schemaDescription: false,
}),
}),
})
.then(res => res.json())
.then(schemaJSON => {
return printSchema(buildClientSchema(schemaJSON.data, { assumeValid: true }))
})
}
fetchGraphQLSchema('YOUR_GRAPH_QL_ENDPOINT').then(
result => {
fetch('HASURA_METADATA_ENDPOINT', { // at the time of this writing 'http://HASURA_ENDPOINT/v1/metadata'
method: 'POST',
headers: {
Accept: 'application/json',
'Content-Type': 'application/json',
'X-Hasura-Role': 'admin',
'x-hasura-admin-secret': 'YOUR_ADMIN_SECRET',
},
body: JSON.stringify({
type: 'add_remote_schema_permissions',
args: {
remote_schema: 'YOUR_REMOTE_SCHEMA_NAME',
role: 'YOUR_DESIRED_ROLE',
definition: {
schema: result,
},
comment: 'remote schema permissions for role: YOUR_DESIRED_ROLE',
},
}),
})
},
)
```
### If the feature is approved, would you be willing to submit a PR?
Unfortunately probably not. I have zero experience with Haskell and no time available.
Contributor guide
Research direction
Start with the remote schema permission flow and the metadata API operation `add_remote_schema_permissions`, comparing it with the role-based access behavior for Actions. Review how `remote_schemas.yaml` is represented and determine how a full-access role should persist as the schema gains operations; done means new remote schema operations are covered without manually updating permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, haskell
- Domain
- api, authorization, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100