Graphql-engine: Permissions: allow select in subquery only

[nukinuki]

I need the data of a table to be available for anonymous but not as a direct query (I don't want it to be able to pull my whole knowledgebase).

Not allowed:

query getClients {
  client { ... }
}

Allowed:

query getProjects {
   projects {
      client { ... }
   }
}

[praveenweb]

Hi @nukinuki, i understand the use-case.
@0x777 will explore the feasibility of implementing such a permission feature.

Meanwhile just curious; would you be able to solve your requirement by creating a Postgres VIEW and setting up anonymous permission for that VIEW? Or do you prefer it to be able to set this up via permissions directly?

[nukinuki]

Creating a view can solve this particular example with object relationship. Any ideas for array relationship?

query getProjects {
   projects {
      contacts {
         contact { ... }
      }
   }
}

The example scheme is:

table project: id, name
table contact: id, name, phone
table project_x_contact: id, project_id, contact_id

[0x777]

@nukinuki Are there any permissions on the projects table? If there aren't then it doesn't matter whether clients can be queried directly or not, you can indirectly just fetch all the clients by fetching all the projects.

[dsandip]

Hey @nukinuki Any update on this? Has your use-case been sorted out? If yes, can you close this issue with some additional information?

[T-Specht]

I would also find such a feature quite useful.

[tirumaraiselvan]

An RFC for hiding top-level query fields (so they can only be accessed through relationships) is published here: https://github.com/0x777/graphql-engine/blob/select-permission-improvements/rfcs/disable-query-and-subscription-root-fields.md

Please feel free to give your comments here: https://github.com/hasura/graphql-engine/pull/4110/files

[tirumaraiselvan]

Closing this in favour of #696