hasura / hasura/graphql-engine

(Remote Schema) Introspection descriptions only available for admin role

Open
#9,407 7 comments 0 reactions 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version:v2.17.0-cloud.1
CLI Version (for CLI related issue):

### Environment

Cloud

### What is the current behaviour?

When viewing Docs, or running introspections queries with a role that is not admin, I am unable to see the description for queries, mutations, types, etc.

### What is the expected behaviour?

I would like to be able to see the description within the schema introspection as a role other than admin

### How to reproduce the issue?

1. Run following query in against a hasura cloud instance with a role other than admin:
{
__schema {
types {
name
description
}
}
}

### Screenshots or Screencast

![introspection_query](https://user-images.githubusercontent.com/38215983/215566353-156f6e51-d3f3-491d-bf47-f2bed0698e60.png)

### Keywords
introspection
admin

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue on a Hasura Cloud instance using a non-admin role and the provided __schema query. Compare the introspection response and Docs behavior with an admin role, then trace the remote-schema introspection authorization path. Done means schema descriptions for queries, mutations, and types are visible to permitted non-admin roles without exposing unrelated information.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.