hasura / hasura/graphql-engine
Increase the scope of inheritance in inherited roles for mutations and remote schema permissions
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Is your proposal related to a problem?
Currently, when a parent role inherits mutations or remote schema permissions from its children's roles, the parent role will only be able to inherit the permission if the permissions of the children roles are exactly the same, otherwise the permission for that entity of the parent role is marked as inconsistent in the metadata. This is quite limiting as it is very rare that two roles will have exactly the same permissions as it defeats the purpose of having different roles in the first place.
### Describe the solution you'd like
Ideally, we'd like to have the inheritance as we have in select permissions, where two permissions can be combined to create a new combined permission, but unfortunately, that will not be possible because with select permissions there can be no conflicts while combining two permissions, but in mutation and remote schema permissions there can be conflicts.
For example:
Consider the following update permissions for two different roles:
1. `role1`
```json
{
"columns": [
"title",
"content",
"category"
],
"filter": {
"author_id": "X-HASURA-AUTHOR-ID"
},
"check": {
"content": {
"_ne": ""
}
},
"set": {
"updated_at": "NOW()"
}
}
```
2. `role2`
```json
{
"columns": [
"title",
"content",
"category"
],
"filter": {
"author_id": "X-HASURA-USER-ID"
},
"check": {
"content": {
"_ne": ""
}
},
"set": {
"updated_at": "NOW()"
}
}
```
The permissions are similar except the `filter` path which refer different session variables, in this case, there is no good way to combine these permissions into one and this is called as a **conflict**.
#### Proposed solutions
TODO
### Describe alternatives you've considered
Currently, the user can resolve an inconsitency by explicitly adding a permission for the inconsistent role entity which overrides the inherited permission.
### If the feature is approved, would you be willing to submit a PR?
### Related issues
https://github.com/hasura/graphql-engine/issues/8063
https://github.com/hasura/graphql-engine/issues/8343
https://github.com/hasura/graphql-engine/issues/8334
Contributor guide
Research direction
The issue names no files or tests; begin by reviewing inherited select-permission handling and the related issues 8063, 8343, and 8334. Define how mutation and remote schema permissions should combine, including conflict cases, then identify the affected implementation and tests; done means the behavior is specified and validated for compatible and conflicting child permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql
- Domain
- api, authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100