hasura / hasura/graphql-engine

Hasura generated graphql schema doesn't account for nullable relations when used with row level permissions

Open
#7,960 1 comment 8 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: `hasura/graphql-engine:v2.1.0.cli-migrations-v3`

### Environment

### What is the expected behaviour?

Let's take an exemplary graphql schema definition:
```gql
type orgs {
id: String!
name: String!
creator_id: String!
}

type task_assignation_orgs {
id: String!
org_id: String!
assignation_id: String!
org: orgs!
}

type task_assignations {
id: String!
orgs_assignations: [task_assignation_orgs!]!
}
```

Should be converted to this when there is any "row-level-access-permissions" for the role the user currently have. For instance if the role "user", if on the table "orgs" we have a permission like: `{"creator_id": {"_eq": "X-hasura-user-id"}}` the generated graphql schema for the role user should be:

```gql
type orgs {
id: String!
name: String!
creator_id: String!
}

type task_assignation_orgs {
id: String!
org_id: String!
assignation_id: String!
# here this object relation should be marked as possibly null, since if the current user isn't the one in "creator_id" of the org, the result of the relation gonna be null
org: orgs
}

type task_assignations {
id: String!
orgs_assignations: [task_assignation_orgs!]!
}
```

### Keywords

schema nullable relation permissions

### What is the current behaviour?

Currently, all the object relations to from one table to another don't take into account the fact that some row-level-permission may restrict the user from fetching the related data.

### Any possible solutions?

The same way we generate different schema types for columns depending on the differents roles the user posses when hitting the API (eg: we are masking the columns that a role is not allowed to access to from the graphql roots types). The graphql schema generation should also take into account the fact that an object relation to another table, if the role of the current user have some "row level permissions" on this other table, may result to a "null" if the row-level-permission doesn't grant the user access to the other table.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.