hasura / hasura/graphql-engine

Increase the scope of inheritance in inherited roles for mutations and remote schema permissions

Open
#8,372 4 comments 10 reactions 0 assignees View on GitHub
k/enhancement t/product-platform
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?

Currently, when a parent role inherits mutations or remote schema permissions from its children's roles, the parent role will only be able to inherit the permission if the permissions of the children roles are exactly the same, otherwise the permission for that entity of the parent role is marked as inconsistent in the metadata. This is quite limiting as it is very rare that two roles will have exactly the same permissions as it defeats the purpose of having different roles in the first place.

### Describe the solution you'd like

Ideally, we'd like to have the inheritance as we have in select permissions, where two permissions can be combined to create a new combined permission, but unfortunately, that will not be possible because with select permissions there can be no conflicts while combining two permissions, but in mutation and remote schema permissions there can be conflicts.

For example:

Consider the following update permissions for two different roles:

1. `role1`
```json
{
"columns": [
"title",
"content",
"category"
],
"filter": {
"author_id": "X-HASURA-AUTHOR-ID"
},
"check": {
"content": {
"_ne": ""
}
},
"set": {
"updated_at": "NOW()"
}
}
```

2. `role2`
```json
{
"columns": [
"title",
"content",
"category"
],
"filter": {
"author_id": "X-HASURA-USER-ID"
},
"check": {
"content": {
"_ne": ""
}
},
"set": {
"updated_at": "NOW()"
}
}
```

The permissions are similar except the `filter` path which refer different session variables, in this case, there is no good way to combine these permissions into one and this is called as a **conflict**.

#### Proposed solutions

TODO

### Describe alternatives you've considered

Currently, the user can resolve an inconsitency by explicitly adding a permission for the inconsistent role entity which overrides the inherited permission.

### If the feature is approved, would you be willing to submit a PR?

### Related issues

https://github.com/hasura/graphql-engine/issues/8063
https://github.com/hasura/graphql-engine/issues/8343
https://github.com/hasura/graphql-engine/issues/8334

Contributor guide

Open the contributing guide

Research direction

The issue names no files or tests; begin by reviewing inherited select-permission handling and the related issues 8063, 8343, and 8334. Define how mutation and remote schema permissions should combine, including conflict cases, then identify the affected implementation and tests; done means the behavior is specified and validated for compatible and conflicting child permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.