hasura / hasura/graphql-engine
Queries to remote schemas are not transparently forwarded when using input variables
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
This is a follow-up to #8698
### Version Information
Server Version: 2.15.0
### What is the current behaviour?
#### Variable are renamed
When a query using input variables (not scalars) is made against a remote schema, the query is not forwarded as-is, but rewritten, renaming the variables in the process, for example this:
```gql
query MyQuery($filter: TodoFilterInput) {
todos(filter: $filter) {
id
done
task
}
}
```
Becomes this:
```gql
query MyQuery($hasura_json_var_1: TodoFilterInput) {
todos(filter: $hasura_json_var_1) {
id
done
task
}
}
```
### When using prefixes, variables are removed and inlined
The problem is worse when prefixes are used, the variables will be removed and inlined. Given the remote schema prefix `remote_`:
```gql
query MyQuery($filter: remote_TodoFilterInput) {
todos(filter: $filter) {
id
done
task
}
}
```
And the variables:
```json
{
"filter": {
"task": "task filter"
}
}
```
The actual query becomes:
```gql
query MyQuery($hasura_json_var_1: String) {
todos(filter: { task: $hasura_json_var_1}) {
id
done
task
}
}
```
With variables:
```json
{
"hasura_json_var_1": "task filter"
},
```
Both of these are an issue if the user expects requests to be forwarded to the remote schema without changes.
Particularly relevant if the user has, for example, allow-lists in their remote schema.
### What is the expected behaviour?
Hasura should forward requests to remote schemas as-is, without renaming variables or in-lining their values.
Contributor guide
Assessment
This issue has not been assessed yet.