How to hide query field value depending on role?

[matart15]

Lets say

I have Post table

model Post {
  id: string;
  title: string;
  detail: string;
  someData: string;
}

I have multiple dynamic roles ( with permissions ).

• Admin : can see someData field
• User : can not see someData field

My requirement is

• My UI needs to display all Post fields.
• If role does not have permission to see someData My UI will just display empty.

Ideally i would send this query and depending on permission someData will return null

query post {
  Post {
    id
    title
    detail
    someData
  }
}

If i set Permission on User, It hides someData field on query. Which results throwing someData1 does not exist on post query error

How do set permission and not Hide someData field?

[matart15]

If my Roles and permissions are static, I can create 2 separate query and use according to my roles

query AdminPost {
  Post {
    id
    title
    detail
    someData
  }
}

query UserPost {
  Post {
    id
    title
    detail
  }
}

But, My permissions are set dynamically for users

[meetzaveri]

No worries, can I know which Hasura version are you using ?

Also to clarify, this error is not Hasura specific error but rather than related GraphQL spec in general. For reference - https://spec.graphql.org/October2021/#sec-Handling-Field-Errors

Given the fact you decided not to include that column in permission for user role, then Hasura will run introspection query which will return with the field being omitted in generated schema and thus when you query, it will result into error (the validation error which graphql throws upon execution)

[matart15]

I am using hasura v2.14.1

Also to clarify, this error is not Hasura specific error but rather than related GraphQL spec in general.

Yes I understand. I was just being lazy and looking for out of box solution. I can always create new query or mutation wit remote schema or Hasura action. and return null depending on permission

But creating and managing whole express server just for few fields sounded too much

If i go down this route ( create express graphql server ) there is no merit of using hasura

[matart15]

@meetzaveri

Thank you. I was just wondering If I am missing out some implemented feature. Thanks to you now I know that it can't be done without custom server.

[leoalves]

Instead of setting the permission to the field you could:

If somedata is a single field you can create a computedField and only return the row value if the role is admin otherwise return null.

If somedata is a group of fields I would create a view, hide the view from the root_query, add a relationship between the view and the table and set the permission to the view allowing role admin to return the data and other roles with a permission that would always be false. Something like this:
https://hasura.io/docs/latest/auth/authorization/role-multiple-rules/

[matart15]

@leoalves

For now I created remote schema and created custom query with apolloServer.

I will try https://hasura.io/docs/latest/auth/authorization/role-multiple-rules/ later.

Thank you