graphql-engine/server/tests-py/queries/graphql_query/permissions
Karthikeyan Chinnakonda 92026b769f [Preview] Inherited roles for postgres read queries
fixes #3868

docker image - `hasura/graphql-engine:inherited-roles-preview-48b73a2de`

Note:

To be able to use the inherited roles feature, the graphql-engine should be started with the env variable `HASURA_GRAPHQL_EXPERIMENTAL_FEATURES` set to `inherited_roles`.

Introduction
------------

This PR implements the idea of multiple roles as presented in this [paper](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/FGALanguageICDE07.pdf). The multiple roles feature in this PR can be used via inherited roles. An inherited role is a role which can be created by combining multiple singular roles. For example, if there are two roles `author` and `editor` configured in the graphql-engine, then we can create a inherited role with the name of `combined_author_editor` role which will combine the select permissions of the `author` and `editor` roles and then make GraphQL queries using the `combined_author_editor`.

How are select permissions of different roles are combined?
------------------------------------------------------------

A select permission includes 5 things:

1. Columns accessible to the role
2. Row selection filter
3. Limit
4. Allow aggregation
5. Scalar computed fields accessible to the role

 Suppose there are two roles, `role1` gives access to the `address` column with row filter `P1` and `role2` gives access to both the `address` and the `phone` column with row filter `P2` and we create a new role `combined_roles` which combines `role1` and `role2`.

Let's say the following GraphQL query is queried with the `combined_roles` role.

```graphql
query {
   employees {
     address
     phone
   }
}
```

This will translate to the following SQL query:

```sql

 select
    (case when (P1 or P2) then address else null end) as address,
    (case when P2 then phone else null end) as phone
 from employee
 where (P1 or P2)
```

The other parameters of the select permission will be combined in the following manner:

1. Limit - Minimum of the limits will be the limit of the inherited role
2. Allow aggregations - If any of the role allows aggregation, then the inherited role will allow aggregation
3. Scalar computed fields - same as table column fields, as in the above example

APIs for inherited roles:
----------------------

1. `add_inherited_role`

`add_inherited_role` is the [metadata API](https://hasura.io/docs/1.0/graphql/core/api-reference/index.html#schema-metadata-api) to create a new inherited role. It accepts two arguments

`role_name`: the name of the inherited role to be added (String)
`role_set`: list of roles that need to be combined (Array of Strings)

Example:

```json
{
  "type": "add_inherited_role",
  "args": {
      "role_name":"combined_user",
      "role_set":[
          "user",
          "user1"
      ]
  }
}
```

After adding the inherited role, the inherited role can be used like single roles like earlier

Note:

An inherited role can only be created with non-inherited/singular roles.

2. `drop_inherited_role`

The `drop_inherited_role` API accepts the name of the inherited role and drops it from the metadata. It accepts a single argument:

`role_name`: name of the inherited role to be dropped

Example:

```json

{
  "type": "drop_inherited_role",
  "args": {
      "role_name":"combined_user"
  }
}
```

Metadata
---------

The derived roles metadata will be included under the `experimental_features` key while exporting the metadata.

```json
{
  "experimental_features": {
    "derived_roles": [
      {
        "role_name": "manager_is_employee_too",
        "role_set": [
          "employee",
          "manager"
        ]
      }
    ]
  }
}
```

Scope
------

Only postgres queries and subscriptions are supported in this PR.

Important points:
-----------------

1. All columns exposed to an inherited role will be marked as `nullable`, this is done so that cell value nullification can be done.

TODOs
-------

- [ ] Tests
   - [ ] Test a GraphQL query running with a inherited role without enabling inherited roles in experimental features
   - [] Tests for aggregate queries, limit, computed fields, functions, subscriptions (?)
   - [ ] Introspection test with a inherited role (nullability changes in a inherited role)
- [ ] Docs
- [ ] Changelog

Co-authored-by: Vamshi Surabhi <6562944+0x777@users.noreply.github.com>
GitOrigin-RevId: 3b8ee1e11f5ceca80fe294f8c074d42fbccfec63
2021-03-08 11:15:10 +00:00
..
inherited_roles [Preview] Inherited roles for postgres read queries 2021-03-08 11:15:10 +00:00
anonymous_can_only_get_published_articles.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
artist_search_tracks_aggregate.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
artist_search_tracks.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
artist_select_query_Track_fail.yaml Rewrite GraphQL schema generation and query parsing (close #2801) (#4111) 2020-08-21 12:27:01 -05:00
artist_select_query_Track.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
in_and_nin.yaml allow session variables in operators which expect array input (#2475) 2019-07-10 15:49:58 +05:30
iregex.yaml Support Postgres POSIX regex operators (close #4317) (#119) 2020-11-27 10:54:52 +00:00
jsonb_has_all.yaml allow session variables in operators which expect array input (#2475) 2019-07-10 15:49:58 +05:30
jsonb_has_any.yaml allow session variables in operators which expect array input (#2475) 2019-07-10 15:49:58 +05:30
select_articles_without_required_headers.yaml Rewrite GraphQL schema generation and query parsing (close #2801) (#4111) 2020-08-21 12:27:01 -05:00
setup.yaml [server] coalesce multiple run_sql calls in tests (#270) 2021-01-06 16:07:22 +00:00
staff_passed_students.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
teardown.yaml Rewrite GraphQL schema generation and query parsing (close #2801) (#4111) 2020-08-21 12:27:01 -05:00
user_can_query_geometry_values_filter_session_vars.yaml Test with postgis 3.0.0 (#3519) 2019-12-18 19:32:15 -06:00
user_can_query_geometry_values_filter.yaml Test with postgis 3.0.0 (#3519) 2019-12-18 19:32:15 -06:00
user_can_query_jsonb_values_filter_session_vars.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
user_can_query_jsonb_values_filter.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
user_can_query_other_users_published_articles.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
user_cannot_access_remarks_col.yaml Fix result ordering in some incorrect tests 2019-11-05 15:15:25 -06:00
user_query_auction.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
user_select_query_article_author.yaml fix postgres query error for object relationship with permission limit, fix #5148 (#5177) 2020-06-25 09:03:37 +05:30
user_select_query_unpublished_articles.yaml introduce v1/graphql (fix #1368) (#2064) 2019-05-10 11:35:10 +05:30
user_should_not_be_able_to_access_books_by_pk.yaml Rewrite GraphQL schema generation and query parsing (close #2801) (#4111) 2020-08-21 12:27:01 -05:00