hasura / hasura/graphql-engine

Support for granting bulk or full access to Remote Schemas

Open
#7,598 2 comments 2 reactions 0 assignees View on GitHub
a/authz c/remote-schemas c/server k/enhancement p/medium
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?

We use the Remote Schema and Actions features of Hasura quite often. The Actions feature supports just mentioning a role name to give it all permissions on that Action.

With Remote Schemas this is not possible, one would need to tick every possible mutation/query/field manually to grant access to all possible operations within that Remote Schema

### Describe the solution you'd like

Would be nice if there is a single checkbox that perhaps corresponds to a configuration option inside of `remote_schemas.yaml` that says grant this role full access to everything this remote schema has to offer.

Also this access remains even when the remote schema changes _(adds new operations)_ so that one doesn't have to go back and update the permissions in Hasura again.

### Describe alternatives you've considered

I am marking everything manually at this stage and checking whether I can automate it using the metadata APIs

#### Update
I did manage to work around this by having a lambda function invoke our Hasura server after it gets deployed to apply permissions. For anyone facing a similar concern here is a basic version _(needs cleanup and some error handling but you get the idea)_ of the code in JavaScript:

```js
const fetch = require('node-fetch')

const {
buildClientSchema,
printSchema,
getIntrospectionQuery,
} = require('graphql/utilities')

function fetchGraphQLSchema(url) {
return fetch(url, {
method: 'POST',
headers: {
Accept: 'application/json',
'Content-Type': 'application/json',
},
body: JSON.stringify({
query: getIntrospectionQuery({
descriptions: false,
schemaDescription: false,
}),
}),
})
.then(res => res.json())
.then(schemaJSON => {
return printSchema(buildClientSchema(schemaJSON.data, { assumeValid: true }))
})
}

fetchGraphQLSchema('YOUR_GRAPH_QL_ENDPOINT').then(
result => {
fetch('HASURA_METADATA_ENDPOINT', { // at the time of this writing 'http://HASURA_ENDPOINT/v1/metadata'
method: 'POST',
headers: {
Accept: 'application/json',
'Content-Type': 'application/json',
'X-Hasura-Role': 'admin',
'x-hasura-admin-secret': 'YOUR_ADMIN_SECRET',
},
body: JSON.stringify({
type: 'add_remote_schema_permissions',
args: {
remote_schema: 'YOUR_REMOTE_SCHEMA_NAME',
role: 'YOUR_DESIRED_ROLE',
definition: {
schema: result,
},
comment: 'remote schema permissions for role: YOUR_DESIRED_ROLE',
},
}),
})
},
)

```

### If the feature is approved, would you be willing to submit a PR?

Unfortunately probably not. I have zero experience with Haskell and no time available.

Contributor guide

Open the contributing guide

Research direction

Start with the remote schema permission flow and the metadata API operation `add_remote_schema_permissions`, comparing it with the role-based access behavior for Actions. Review how `remote_schemas.yaml` is represented and determine how a full-access role should persist as the schema gains operations; done means new remote schema operations are covered without manually updating permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, haskell
Domain
api, authorization, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.