How can I check the variables from frontend before update record

[microwin1668]

Version Information

Server Version:V2.80
CLI Version (for CLI related issue):

What is the current behaviour?

When I update a table , If I did not set where conditions because of forget or a bug .It will update all record. That is not I want and it is risk.

How can I check the variables from frontend before update record. If where condition is empty ,I want to stop this update behave. Can I do some check before update table from backend config by hasura-engine

{
 "where": {},
  "_set": {
    "event_info_id": "12345",
    "attachment_name": "name",
  }
}

[BenoitRanque]

There's a few ways to address this.

If you want to force the update to always require a certain key, for example an id, you can rewrite your query to require that id as a primitive value.

Alternatively, you can perform a check on the value of the where key, for example like so (javascript)

function isEmptyObject(obj) {
  // because Object.keys(new Date()).length === 0;
  // we have to do some additional check
  return obj // 👈 null and undefined check
  && Object.keys(obj).length === 0
  && Object.getPrototypeOf(obj) === Object.prototype
}

const nonEmptyWhere = { prop: 'value' }
if (isEmptyObject(nonEmptyWhere)) {
  // will not log since nonEmptyWhere is not empty
  console.log('this won't log')
}
const emptyWhere = {}
if (isEmptyObject(emptyWhere)) {
  // will log since emptyWhere is empty
  console.log('this will log')
}

Ref

[microwin1668]

There's a few ways to address this.

If you want to force the update to always require a certain key, for example an id, you can rewrite your query to require that id as a primitive value.

Alternatively, you can perform a check on the value of the where key, for example like so (javascript)

function isEmptyObject(obj) {
  // because Object.keys(new Date()).length === 0;
  // we have to do some additional check
  return obj // 👈 null and undefined check
  && Object.keys(obj).length === 0
  && Object.getPrototypeOf(obj) === Object.prototype
}

const nonEmptyWhere = { prop: 'value' }
if (isEmptyObject(nonEmptyWhere)) {
  // will not log since nonEmptyWhere is not empty
  console.log('this won't log')
}
const emptyWhere = {}
if (isEmptyObject(emptyWhere)) {
  // will log since emptyWhere is empty
  console.log('this will log')
}

Ref

Yes, this can prevent it. but did not resolve completely.
If someone post the variables from Exporer API or postman, this risk still not resolve completely.
How can we resolve it from backend or hasura-engine?

[BenoitRanque]

Right, that's a different question, you specifically asked about restricting from the front end.
As you say, any restriction implemented in the front end is opt-in, and can easily be bypassed by the api user.

There's a few ways to make things safer from the backend.

1. Use permission rules to restrict what records a user can update. This should be your primary security mechanism and should be configured such that users are unable to modify any records they should not have access to.
2. Use allow lists to ensure only permitted queries are executed. This can be useful to restrict allowed queries to safer versions within what is allowed by the permission rules. This could be used to prevent users update all records they have permissions for at once.