graphile / crystal

🔮 Graphile's Crystal Monorepo; home to Grafast, PostGraphile, pg-introspection, pg-sql2 and much more!
https://graphile.org/
Other
12.49k stars 568 forks source link

RBAC enhancements: don't fetch column if not allowed to fetch column #2111

Open benjie opened 2 days ago

benjie commented 2 days ago

Since we know what role the request is running as and we know which roles can access each column, we should replace all fetches for ungranted columns with null. This would avoid RBAC errors if you try and request things you're not allowed to (though it may result in non-null blowups).

Maybe this should be achieved via an additional preset, and that preset would make all columns like this nullable?