hasura / hasura/graphql-engine

support more dynamic default role

Open
#8,667 1 comment 1 reaction 0 assignees View on GitHub
k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Is your proposal related to a problem?

We're currently unable to set the `x-hasura-default-role` dynamically (and unable to send a `x-hasura-role` from the client)

jwt claims path parsing is [currently limited](https://cs.github.com/hasura/graphql-engine/blob/4a129042fa9326799a0d69f79462a11d044a6a1d/server/src-lib/Data/Parser/JSONPath.hs#L18) to a simplified subset of JSONPath instead of [full fledged support](https://goessner.net/articles/JsonPath/index.html#e2) (mainly limited through hasura not the underlying library iiuc). Is there a good reason for this?
```
$.groups[?(@.length-1)]. Accept letters, digits, underscore (_) or hyphen (-) only. Use single quotes enclosed in bracket (['...']) if there is any special character
```

For context, in our usecase we're setting the. `x-hasura-allowed-roles` to `"path": "$.groups"` and would like to set the default role based on a specific (mutually exclusive) prefix/string match.

### Describe the solution you'd like
Ideally we want something like
`$.groups[?(@.types.indexOf('prefix-') != -1)]`

Note: this might be hard as there is currently no haskell library that supports these features afaik..

### Describe alternatives you've considered
Other options are to allow multiple default roles `["group-prefix-1", "group-prefix-2"]` and return the first match

### If the feature is approved, would you be willing to submit a PR?
Happy to attempt, interested to hear your thoughts.

Contributor guide

Open the contributing guide

Research direction

Start with server/src-lib/Data/Parser/JSONPath.hs, which the issue identifies as the current simplified JSONPath parser. Compare its supported syntax with the requested prefix-based group matching and investigate whether a Haskell library can provide the needed features. Done should include an agreed way to derive x-hasura-default-role dynamically while preserving existing claim behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
haskell
Domain
authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.