hasura / hasura/graphql-engine
support more dynamic default role
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Is your proposal related to a problem?
We're currently unable to set the `x-hasura-default-role` dynamically (and unable to send a `x-hasura-role` from the client)
jwt claims path parsing is [currently limited](https://cs.github.com/hasura/graphql-engine/blob/4a129042fa9326799a0d69f79462a11d044a6a1d/server/src-lib/Data/Parser/JSONPath.hs#L18) to a simplified subset of JSONPath instead of [full fledged support](https://goessner.net/articles/JsonPath/index.html#e2) (mainly limited through hasura not the underlying library iiuc). Is there a good reason for this?
```
$.groups[?(@.length-1)]. Accept letters, digits, underscore (_) or hyphen (-) only. Use single quotes enclosed in bracket (['...']) if there is any special character
```
For context, in our usecase we're setting the. `x-hasura-allowed-roles` to `"path": "$.groups"` and would like to set the default role based on a specific (mutually exclusive) prefix/string match.
### Describe the solution you'd like
Ideally we want something like
`$.groups[?(@.types.indexOf('prefix-') != -1)]`
Note: this might be hard as there is currently no haskell library that supports these features afaik..
### Describe alternatives you've considered
Other options are to allow multiple default roles `["group-prefix-1", "group-prefix-2"]` and return the first match
### If the feature is approved, would you be willing to submit a PR?
Happy to attempt, interested to hear your thoughts.
Contributor guide
Research direction
Start with server/src-lib/Data/Parser/JSONPath.hs, which the issue identifies as the current simplified JSONPath parser. Compare its supported syntax with the requested prefix-based group matching and investigate whether a Haskell library can provide the needed features. Done should include an agreed way to derive x-hasura-default-role dynamically while preserving existing claim behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell
- Domain
- authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100