hasura / hasura/graphql-engine

Pass Inherited Roles using authentication headers

Open
#7,731 1 comment 0 reactions 0 assignees View on GitHub
k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?
Currently, we are syncing inherited roles with our own permissioning system by refreshing the metadata every 5 seconds.
This solution is pretty hard to maintain and it's prune to errors.

### Describe the solution you'd like

I would like to be able to pass the inherited role using an Authentication header.
For example, by passing `X-Hasura-Role: "role1, role2, role3"` will grant all the specified roles to user. (obs. I don't know if it's ok to use the same header name here..)

This fix is very helpful when you configure which "features" should be enabled for the specified user.
For example, if you user has the "premium plan", we will enable more roles to allow the user to fetch more information.

### Describe alternatives you've considered
Currently, we are creating inherited_roles dynamically for each user by updating Hasura metadata every 5 seconds.
```yaml
# inherited_roles.yaml
- role_name: api_1
role_set:
- basic-unit-records
- basic-unit-information
- view-unit-state
- basic-unit-packets
- role_name: user_1
role_set:
- user
- role_name: user_2
role_set:
- change-relay-state
- basic-unit-information
- edit-interface-configuration
- user
- internal-user

```

### If the feature is approved, would you be willing to submit a PR?
Unfortunately, I don't know very well Haskell, if you guide me a bit on how this functionality could be implemented I'm open to give it a try.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by tracing authentication-header handling and inherited-role authorization in the GraphQL engine; done means a documented header-based way to grant multiple inherited roles without repeatedly updating metadata, with clarified header semantics and coverage for the requested behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, haskell
Domain
api, authentication, authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.