hasura / hasura/graphql-engine
Pass Inherited Roles using authentication headers
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Is your proposal related to a problem?
Currently, we are syncing inherited roles with our own permissioning system by refreshing the metadata every 5 seconds.
This solution is pretty hard to maintain and it's prune to errors.
### Describe the solution you'd like
I would like to be able to pass the inherited role using an Authentication header.
For example, by passing `X-Hasura-Role: "role1, role2, role3"` will grant all the specified roles to user. (obs. I don't know if it's ok to use the same header name here..)
This fix is very helpful when you configure which "features" should be enabled for the specified user.
For example, if you user has the "premium plan", we will enable more roles to allow the user to fetch more information.
### Describe alternatives you've considered
Currently, we are creating inherited_roles dynamically for each user by updating Hasura metadata every 5 seconds.
```yaml
# inherited_roles.yaml
- role_name: api_1
role_set:
- basic-unit-records
- basic-unit-information
- view-unit-state
- basic-unit-packets
- role_name: user_1
role_set:
- user
- role_name: user_2
role_set:
- change-relay-state
- basic-unit-information
- edit-interface-configuration
- user
- internal-user
```
### If the feature is approved, would you be willing to submit a PR?
Unfortunately, I don't know very well Haskell, if you guide me a bit on how this functionality could be implemented I'm open to give it a try.
Contributor guide
Research direction
No files, tests, or entry points are named. Start by tracing authentication-header handling and inherited-role authorization in the GraphQL engine; done means a documented header-based way to grant multiple inherited roles without repeatedly updating metadata, with clarified header semantics and coverage for the requested behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, haskell
- Domain
- api, authentication, authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100