hasura / hasura/graphql-engine
Hasura generated graphql schema doesn't account for nullable relations when used with row level permissions
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: `hasura/graphql-engine:v2.1.0.cli-migrations-v3`
### Environment
### What is the expected behaviour?
Let's take an exemplary graphql schema definition:
```gql
type orgs {
id: String!
name: String!
creator_id: String!
}
type task_assignation_orgs {
id: String!
org_id: String!
assignation_id: String!
org: orgs!
}
type task_assignations {
id: String!
orgs_assignations: [task_assignation_orgs!]!
}
```
Should be converted to this when there is any "row-level-access-permissions" for the role the user currently have. For instance if the role "user", if on the table "orgs" we have a permission like: `{"creator_id": {"_eq": "X-hasura-user-id"}}` the generated graphql schema for the role user should be:
```gql
type orgs {
id: String!
name: String!
creator_id: String!
}
type task_assignation_orgs {
id: String!
org_id: String!
assignation_id: String!
# here this object relation should be marked as possibly null, since if the current user isn't the one in "creator_id" of the org, the result of the relation gonna be null
org: orgs
}
type task_assignations {
id: String!
orgs_assignations: [task_assignation_orgs!]!
}
```
### Keywords
schema nullable relation permissions
### What is the current behaviour?
Currently, all the object relations to from one table to another don't take into account the fact that some row-level-permission may restrict the user from fetching the related data.
### Any possible solutions?
The same way we generate different schema types for columns depending on the differents roles the user posses when hitting the API (eg: we are masking the columns that a role is not allowed to access to from the graphql roots types). The graphql schema generation should also take into account the fact that an object relation to another table, if the role of the current user have some "row level permissions" on this other table, may result to a "null" if the row-level-permission doesn't grant the user access to the other table.
Contributor guide
Assessment
This issue has not been assessed yet.