search

hasura / graphql-engine

Blazing fast, instant realtime GraphQL APIs on your DB with fine grained access control, also trigger webhooks on database events.
https://hasura.io
Apache License 2.0
31.06k stars 2.76k forks source link

Allow permissions on specific fields in hasura actions #9134

Open AskMeAgain opened 1 year ago

AskMeAgain commented 1 year ago

Is your proposal related to a problem?

We execute an action and we want to be able to filter the result via permissions. Currently we are only able to set a general "Allowed" or "Not Allowed" check on the complete action, but it would be pretty good if we could have the same fine grained permissions as we have on a DB table.

The problem with this is that we now move this action into our backend to do the filtering ourselves, but this is something which should be possible in hasura.

Describe the solution you'd like

Example would be:

  1. Execute an action
  2. Set permission on this action so that a user is only able to see data entries when a column has value X (which we get from the hasura session).
mnaveenriaz commented 1 year ago

Also Permission at top level based on static or session variables not at row level. This applies to both Hasura Actions and DB Tables.

manasag commented 5 months ago

Hi, I want to update that we are launching Hasura V3 (DDN) this month. V3 aims to bring actions closer to how its available for permissions in comparison to DB models. I believe for our scenario, you should be able to use a "Preset Argument" feature, which can be used to filter out a column based on a session value (We will share more details on how this will work).

I would highly suggest to join us to see the full power of Hasura DDN at the Hasura Dev Day on April 16 🎉. Sign up here: https://hasura.io/dev-day. Can't make it? Sign up anyway and we'll send you the recording.