hasura / hasura/graphql-engine
Better error message when permissions not granted
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Is your proposal related to a problem?
I just added an "updated_at" column to my table using Hasura's frequently used columns feature. Either my metadata got messed up or Hasura didn't add user permissions for the new column. I constructed a query using the API explorer where I searched for records newer than some timestamp. The query did not work and the error message provided by Hasura was not helpful.
### Describe the solution you'd like
I'd like to see something equivalent to a HTTP 403, preferably indicating which attribute I lack the permissions to access. Looking at the Hasura engine logs, all I saw was:
```
2022-01-12T06:44:36.512936133Z {"type":"http-log","timestamp":"2022-01-12T06:44:36.512+0000","level":"error","detail":{"operation":{"user_vars":{"x-hasura-role":"user","x-hasura-user-id":"auth0|abc"},"error":{"path":"$.query","error":"not a valid graphql query","code":"validation-failed"},"request_id":"cbf3ee1e-bab1-42b0-864a-65b3a24807ca","response_size":81,"query":{"variables":{"updated_at":"Thu, 01 Jan 1970 00:00:00 GMT","limit":5},"query":""},"request_mode":"error"},"request_id":"cbf3ee1e-bab1-42b0-864a-65b3a24807ca","http_info":{"status":200,"http_version":"HTTP/1.1","url":"/v1/graphql","ip":"172.19.0.1","method":"POST","content_encoding":null}}}
```
I'd expect a "not a valid graphql query" message to only appear for syntactically invalid queries. Because of that error message, I spent a couple of hours trying to figure out what was wrong with the query.
### Describe alternatives you've considered
I'd like to see an HTTP 403 error or the GraphQL response to indicate permissions are missing in the extended error response. If there's a concern about leaking data that way, it'd be helpful if it could at least be enabled in development mode. It could also be done in the engine logs, as those are never user visible.
### If the feature is approved, would you be willing to submit a PR?
Possibly. I'm not entirely sure what's involved.
Contributor guide
Assessment
This issue has not been assessed yet.