mirror of
https://github.com/hasura/graphql-engine.git
synced 2024-12-17 20:41:49 +03:00
92026b769f
fixes #3868 docker image - `hasura/graphql-engine:inherited-roles-preview-48b73a2de` Note: To be able to use the inherited roles feature, the graphql-engine should be started with the env variable `HASURA_GRAPHQL_EXPERIMENTAL_FEATURES` set to `inherited_roles`. Introduction ------------ This PR implements the idea of multiple roles as presented in this [paper](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/FGALanguageICDE07.pdf). The multiple roles feature in this PR can be used via inherited roles. An inherited role is a role which can be created by combining multiple singular roles. For example, if there are two roles `author` and `editor` configured in the graphql-engine, then we can create a inherited role with the name of `combined_author_editor` role which will combine the select permissions of the `author` and `editor` roles and then make GraphQL queries using the `combined_author_editor`. How are select permissions of different roles are combined? ------------------------------------------------------------ A select permission includes 5 things: 1. Columns accessible to the role 2. Row selection filter 3. Limit 4. Allow aggregation 5. Scalar computed fields accessible to the role Suppose there are two roles, `role1` gives access to the `address` column with row filter `P1` and `role2` gives access to both the `address` and the `phone` column with row filter `P2` and we create a new role `combined_roles` which combines `role1` and `role2`. Let's say the following GraphQL query is queried with the `combined_roles` role. ```graphql query { employees { address phone } } ``` This will translate to the following SQL query: ```sql select (case when (P1 or P2) then address else null end) as address, (case when P2 then phone else null end) as phone from employee where (P1 or P2) ``` The other parameters of the select permission will be combined in the following manner: 1. Limit - Minimum of the limits will be the limit of the inherited role 2. Allow aggregations - If any of the role allows aggregation, then the inherited role will allow aggregation 3. Scalar computed fields - same as table column fields, as in the above example APIs for inherited roles: ---------------------- 1. `add_inherited_role` `add_inherited_role` is the [metadata API](https://hasura.io/docs/1.0/graphql/core/api-reference/index.html#schema-metadata-api) to create a new inherited role. It accepts two arguments `role_name`: the name of the inherited role to be added (String) `role_set`: list of roles that need to be combined (Array of Strings) Example: ```json { "type": "add_inherited_role", "args": { "role_name":"combined_user", "role_set":[ "user", "user1" ] } } ``` After adding the inherited role, the inherited role can be used like single roles like earlier Note: An inherited role can only be created with non-inherited/singular roles. 2. `drop_inherited_role` The `drop_inherited_role` API accepts the name of the inherited role and drops it from the metadata. It accepts a single argument: `role_name`: name of the inherited role to be dropped Example: ```json { "type": "drop_inherited_role", "args": { "role_name":"combined_user" } } ``` Metadata --------- The derived roles metadata will be included under the `experimental_features` key while exporting the metadata. ```json { "experimental_features": { "derived_roles": [ { "role_name": "manager_is_employee_too", "role_set": [ "employee", "manager" ] } ] } } ``` Scope ------ Only postgres queries and subscriptions are supported in this PR. Important points: ----------------- 1. All columns exposed to an inherited role will be marked as `nullable`, this is done so that cell value nullification can be done. TODOs ------- - [ ] Tests - [ ] Test a GraphQL query running with a inherited role without enabling inherited roles in experimental features - [] Tests for aggregate queries, limit, computed fields, functions, subscriptions (?) - [ ] Introspection test with a inherited role (nullability changes in a inherited role) - [ ] Docs - [ ] Changelog Co-authored-by: Vamshi Surabhi <6562944+0x777@users.noreply.github.com> GitOrigin-RevId: 3b8ee1e11f5ceca80fe294f8c074d42fbccfec63
150 lines
5.6 KiB
Haskell
150 lines
5.6 KiB
Haskell
module Hasura.GraphQL.Schema.Common where
|
||
|
||
import Hasura.Prelude
|
||
|
||
import qualified Data.Aeson as J
|
||
import qualified Data.HashMap.Strict as Map
|
||
import qualified Data.HashMap.Strict.InsOrd as OMap
|
||
import qualified Data.Text as T
|
||
|
||
import Data.Either (isRight)
|
||
import Data.Text.Extended
|
||
import Language.GraphQL.Draft.Syntax as G
|
||
|
||
import qualified Hasura.Backends.Postgres.SQL.Types as PG
|
||
import qualified Hasura.GraphQL.Execute.Types as ET (GraphQLQueryType)
|
||
import qualified Hasura.GraphQL.Parser as P
|
||
import qualified Hasura.RQL.IR.Select as IR
|
||
|
||
import Hasura.GraphQL.Parser (UnpreparedValue)
|
||
import Hasura.RQL.Types
|
||
|
||
type SelectExp b = IR.AnnSimpleSelG b (UnpreparedValue b)
|
||
type AggSelectExp b = IR.AnnAggregateSelectG b (UnpreparedValue b)
|
||
type ConnectionSelectExp b = IR.ConnectionSelect b (UnpreparedValue b)
|
||
type SelectArgs b = IR.SelectArgsG b (UnpreparedValue b)
|
||
type TablePerms b = IR.TablePermG b (UnpreparedValue b)
|
||
type AnnotatedFields b = IR.AnnFieldsG b (UnpreparedValue b)
|
||
type AnnotatedField b = IR.AnnFieldG b (UnpreparedValue b)
|
||
|
||
data QueryContext =
|
||
QueryContext
|
||
{ qcStringifyNum :: !Bool
|
||
, qcQueryType :: !ET.GraphQLQueryType
|
||
, qcRemoteRelationshipContext :: !(HashMap RemoteSchemaName (IntrospectionResult, ParsedIntrospection))
|
||
, qcFunctionPermsContext :: !FunctionPermissionsCtx
|
||
}
|
||
|
||
textToName :: MonadError QErr m => Text -> m G.Name
|
||
textToName textName = G.mkName textName `onNothing` throw400 ValidationFailed
|
||
("cannot include " <> textName <<> " in the GraphQL schema because "
|
||
<> " it is not a valid GraphQL identifier")
|
||
|
||
partialSQLExpToUnpreparedValue :: PartialSQLExp b -> P.UnpreparedValue b
|
||
partialSQLExpToUnpreparedValue (PSESessVar pftype var) = P.UVSessionVar pftype var
|
||
partialSQLExpToUnpreparedValue (PSESQLExp sqlExp) = P.UVLiteral sqlExp
|
||
|
||
mapField
|
||
:: Functor m
|
||
=> P.InputFieldsParser m (Maybe a)
|
||
-> (a -> b)
|
||
-> P.InputFieldsParser m (Maybe b)
|
||
mapField fp f = fmap (fmap f) fp
|
||
|
||
parsedSelectionsToFields
|
||
:: (Text -> a) -- ^ how to handle @__typename@ fields
|
||
-> OMap.InsOrdHashMap G.Name (P.ParsedSelection a)
|
||
-> IR.Fields a
|
||
parsedSelectionsToFields mkTypename = OMap.toList
|
||
>>> map (FieldName . G.unName *** P.handleTypename (mkTypename . G.unName))
|
||
|
||
numericAggOperators :: [G.Name]
|
||
numericAggOperators =
|
||
[ $$(G.litName "sum")
|
||
, $$(G.litName "avg")
|
||
, $$(G.litName "stddev")
|
||
, $$(G.litName "stddev_samp")
|
||
, $$(G.litName "stddev_pop")
|
||
, $$(G.litName "variance")
|
||
, $$(G.litName "var_samp")
|
||
, $$(G.litName "var_pop")
|
||
]
|
||
|
||
comparisonAggOperators :: [G.Name]
|
||
comparisonAggOperators = [$$(litName "max"), $$(litName "min")]
|
||
|
||
data NodeIdVersion
|
||
= NIVersion1
|
||
deriving (Show, Eq)
|
||
|
||
nodeIdVersionInt :: NodeIdVersion -> Int
|
||
nodeIdVersionInt NIVersion1 = 1
|
||
|
||
currentNodeIdVersion :: NodeIdVersion
|
||
currentNodeIdVersion = NIVersion1
|
||
|
||
instance J.FromJSON NodeIdVersion where
|
||
parseJSON v = do
|
||
versionInt :: Int <- J.parseJSON v
|
||
case versionInt of
|
||
1 -> pure NIVersion1
|
||
_ -> fail $ "expecting version 1 for node id, but got " <> show versionInt
|
||
|
||
mkDescriptionWith :: Maybe PG.PGDescription -> Text -> G.Description
|
||
mkDescriptionWith descM defaultTxt = G.Description $ case descM of
|
||
Nothing -> defaultTxt
|
||
Just (PG.PGDescription descTxt) -> T.unlines [descTxt, "\n", defaultTxt]
|
||
|
||
-- | The default @'skip' and @'include' directives
|
||
defaultDirectives :: [P.DirectiveInfo]
|
||
defaultDirectives =
|
||
[mkDirective $$(G.litName "skip"), mkDirective $$(G.litName "include")]
|
||
where
|
||
ifInputField =
|
||
P.mkDefinition $$(G.litName "if") Nothing $ P.IFRequired $ P.TNamed $
|
||
P.mkDefinition $$(G.litName "Boolean") Nothing P.TIScalar
|
||
dirLocs = map G.DLExecutable
|
||
[G.EDLFIELD, G.EDLFRAGMENT_SPREAD, G.EDLINLINE_FRAGMENT]
|
||
mkDirective name =
|
||
P.DirectiveInfo name Nothing [ifInputField] dirLocs
|
||
|
||
-- TODO why do we do these validations at this point? What does it mean to track
|
||
-- a function but not add it to the schema...?
|
||
-- Auke:
|
||
-- I believe the intention is simply to allow the console to do postgres data management
|
||
-- Karthikeyan: Yes, this is correct. We allowed this pre PDV but somehow
|
||
-- got removed in PDV. OTOH, I’m not sure how prevalent this feature
|
||
-- actually is
|
||
takeValidTables :: forall b. Backend b => TableCache b -> TableCache b
|
||
takeValidTables = Map.filterWithKey graphQLTableFilter . Map.filter tableFilter
|
||
where
|
||
tableFilter = not . isSystemDefined . _tciSystemDefined . _tiCoreInfo
|
||
graphQLTableFilter tableName tableInfo =
|
||
-- either the table name should be GraphQL compliant
|
||
-- or it should have a GraphQL custom name set with it
|
||
isRight (tableGraphQLName @b tableName) ||
|
||
isJust (_tcCustomName $ _tciCustomConfig $ _tiCoreInfo tableInfo)
|
||
|
||
-- TODO and what about graphql-compliant function names here too?
|
||
takeValidFunctions :: forall b. FunctionCache b -> FunctionCache b
|
||
takeValidFunctions = Map.filter functionFilter
|
||
where
|
||
functionFilter = not . isSystemDefined . _fiSystemDefined
|
||
|
||
|
||
-- root field builder helpers
|
||
|
||
requiredFieldParser
|
||
:: (Functor n, Functor m)
|
||
=> (a -> b)
|
||
-> m (P.FieldParser n a)
|
||
-> m (Maybe (P.FieldParser n b))
|
||
requiredFieldParser f = fmap $ Just . fmap f
|
||
|
||
optionalFieldParser
|
||
:: (Functor n, Functor m)
|
||
=> (a -> b)
|
||
-> m (Maybe (P.FieldParser n a))
|
||
-> m (Maybe (P.FieldParser n b))
|
||
optionalFieldParser = fmap . fmap . fmap
|