How to forbid access to resources without specifying permission rules every where and forbid some generated graphql queries

[b3j0f]

Let three objects A, B and C defined as such:

type C {}
type B { content: [C] }
type A { content: [B] }

Only users granted to see A, can view A.content, and thus, A.content.content.

For security and performance reasons, I want to

• define select_permissions on the object A, and not on B and C (time responses is in minutes if I do so)
• forbid generated graphql queries to B and C without pathing by A.content

What is your advice to do the best with the least effort ? ^^'

[0x777]

@b3j0f Regarding the performance:

Can you try your queries on this particular build: hasurabuild/graphql-engine:mono-pr-3362-8cd5313f9. We've introduced an optimization that removes filters that are not needed.

[BenoitRanque]

Note that this feature optimizes the generated SQL, but it does not optimize the DX, you would still need to define permissions on all tables.

For example, given the following permissions on table A, B, and C respectively:

{ user_id: { _eq: 'x-hasura-user-id' } }
{ a: { user_id: { _eq: 'x-hasura-user-id' } } }
{ b: { a: { user_id: { _eq: 'x-hasura-user-id' } } } }

The new optimization will remove the duplicate permission check on B and C, because it is redundant.
But they must still be defined, and must be defined as show above.

[b3j0f]

@BenoitRanque & @0x777

Great news to know such feature exists (somewhere 😆 ) !

Is it a version compatible with the image hasura/graphql-engine:latest.cli-migrations-v2 ?

I saw there is a v3 as well. Is there a doc somewhere ?

Finally, is there a way to forbid direct calls to B and C ?

[BenoitRanque]

1. No. This feature is not released yet, the image linked by @0x777 above is a pre-release build that includes this optimization.
   Currently the latest version of hasura is 2.1.1. The feature should be available in the next release.

2. While not required for this particular feature, we strongly recommend you upgrade to config v3 which is compatible with cli-migrations-v3 images. You can find docs for that here

3. Currently there is not, which is why I must again stress that you must defined permissions for those tables.
   We are internally discussing the possibility of allowing certain tables be omitted from the root of the schema, but there are two caveats:
   a. This is at the internal discussion stage, so we don't know if/when this feature will exist
   b. Even if this feature is added, it would not be a security feature, and permission rules should still be applied to B and C

We are also internally discussing adding console helpers to improve DX when setting such permissions, but again this is at the internal discussion stage so there is no ETA.