Inherited roles¶

Accessibility of a field for an inherited role¶

Accessibility of a field for an inherited role is defined as follows:

1. When all the roles give access to a column C, then C will always be accessible.
2. When not all, but some of the roles give access to the column C then the value of the column C will be outputed when the OR of P1,P2....P(n) is true and when it evaluates to false, the value of the column C will be null, where P is the row filter of the select permissions in which column C is given access to.
3. When none of the roles give access to column C, it won’t be accessible to the inherited role.

Examples¶

Let’s take the example of an users table with the following columns:

1. id - Int - Primary key
2. name - Text
3. email - Text

There are two roles defined namely employee and manager.

1. User role - The user role will be able to access all columns of their row when the session variable X-Hasura-User-Id is equal to the id.
2. Anonymous role - The anonymous role will be able to access only the id and name columns of all the users.

Let’s create a new inherited role called user_anonymous_inherited_role which inherits from the user and the anonymous roles.

1. Executing the query as user role

   POST /v1/graphql HTTP/1.1
   Content-Type: application/json
   X-Hasura-Role: user
   X-Hasura-User-Id: 1
   

   query {
      users {
        id
        name
        email
      }
    }
   

   query { users { id name email } }

   { "data": { "users": [ { "id": 1, "name": "alice", "email": "alice@xyz.com" } ] } }

2. Executing the query as anonymous role

   POST /v1/graphql HTTP/1.1
   Content-Type: application/json
   X-Hasura-Role: anonymous
   

   query {
      users {
        id
        name
      }
    }
   

   query { users { id name } }

   { "data": { "users": [ { "id": 1, "name": "Alice" }, { "id": 2, "name": "Bob" }, { "id": 3, "name": "Sam" } ] } }

3. Executing the query as user_anonymous_inherited_role role

   POST /v1/graphql HTTP/1.1
   Content-Type: application/json
   X-Hasura-Role: user_anonymous_inherited_role
   X-Hasura-User-Id: 1
   

   query {
     users {
       id
       name
       email
     }
   }
   

   query { users { id name email } }

   { "data": { "users": [ { "id": 1, "name": "Alice", "email": "alice@xyz.com" }, { "id": 2, "name": "Bob", "email": null }, { "id": 3, "name": "Sam", "email": null } ] } }

   In the response of the query being executed with the user_anonymous_inherited_role role, there are 3 rows returned and if we compare that to the queries executed as the user and anonymous roles, the results are unioned in the inherited role. But some of the fields have null values despite the value in the database not being null. This can only happen with inherited roles when a column doesn’t have permission in the particular row. In the above example, we see that the email of “Bob” and “Sam” is null but a non null value for “Alice”, this is because the “Alice” row is executed as the user role and the other rows are executed as the anonymous role which is why the value is null.

4. Suppose we have two tables users and authors and similarly two roles user and author are defined. The user role doesn’t have permission to query the authors table and the author role doesn’t have permission to query the users table. With only the user and the author role, we won’t be able to construct a query which fetches data from both the tables. This can be solved by creating an inherited role out of user and author which can query both the tables in a single query.

   POST /v1/graphql HTTP/1.1
   Content-Type: application/json
   X-Hasura-Role: user_authors_inherited_role
   X-Hasura-User-Id: 1
   

   query {
     users {
       id
       name
       email
     }
     authors {
       id
       name
       followers
     }
   }
   

   query { users { id name email } authors { id name followers } }

   { "data": { "users": [ { "id": 1, "name": "Alice", "email": "alice@xyz.com" } ], "authors": [ { "id": 1, "name": "Paulo Coelho", "followers": 10382193 } ] } }