hasura / hasura/graphql-engine

Reference x-hasura-user-id in query/mutation where clause

Open
#8,155 2 comments 1 reaction 0 assignees View on GitHub
k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?

Column presets work great for inserts, but if I want to filter a query or mutation based on the user making the request, I don't want to expose the userId as a parameter/argument in my query/mutation. I can limit this with permissions, but it would be cleaner to be able to not expose the userId as a parameter.

### Describe the solution you'd like

When designing a mutation or query, it would be cool to be able to use something like `$$x-hasura-user-id` as a value, and have the server dynamically replace it with the `x-hasura-user-id` value. This way, we can reference the user who is making the request within where clauses without opening up a userid argument to arbitrary values.

### Describe alternatives you've considered

Alternatives to this issue would be to create an action that passes through my api so I can grab the user id, or limiting access to other rows with permissions.

Actions require creating more boilerplate code, and permissions sort of punt the problem.

### If the feature is approved, would you be willing to submit a PR?

Perhaps if I have the time.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how GraphQL query and mutation where clauses are handled and how x-hasura-user-id is made available during request processing. Compare the requested behavior with column presets and permissions, both mentioned in the issue, and identify tests covering where-clause values. Done means $$x-hasura-user-id works in both query and mutation where clauses without exposing a userId argument.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.