Hacker News new | ask | show | jobs
by vsurabhi 2894 days ago
> What I'm not seeing is how do you ..

You can write fairly complex rules with the access control layer ! The first two conditions are possible (except for the project is only visible on Mondays).

  allow select on rows which satisfy this property: 
  { "project_type" : { "_eq" : "whatever" } }

  allow update on rows which satisfy this property: 
  { "closed_data" : { "_is_null" : true } }
The idea is simple, we provide a boolean expression based access control layer which can use variables from headers. When you can't specify it using the access control layer, you can write this in your own graphql layer and schema stitch with hasura. So you only have to write what is not possible with the access control layer.

> The other point I don't see is how do you ...

You can use the tooling around Postgres ! You can create an `ON INSERT` trigger on the table and listen to these events.

We're launching something very cool in the subscriptions/event-source to solve these kinds of problems. We also have 2 nice projects that work independent of the graphql-engine to help with change subscription on postgres (skor[1], pgdeltastream[2])

[1] https://github.com/hasura/skor [2] https://github.com/hasura/pgdeltastream
2 comments
kilburn 2894 days ago
> u can write fairly complex rules with the access control layer

Oh, I see. As a suggestion then, many business rules are not tied to roles. You may want to look into some "always enforced rules" or something like that, to avoid having to repeat these rules for each role (and the maintenance nightmare this entails).

> your own graphql layer and schema stitch with hasura

Again, I'm not versed in GraphQL in general, so this is from my ignorance. Maybe you could provide some example/tutorial on "stitching your own GraphQL apis with hasura" (your other examples, posts and tutorials are awesome btw!).

> You can use the tooling around Postgres

Fair enough. I've always found a bit hard to properly manage and test these native features (much harder than managing/testing pure code), but it is a sound solution nonetheless. Maybe you want to hint to these other projects somewhere in hasura's docs (I've checked them and couldn't find it, but maybe I'm just blind/didn't look hard enough).

Again, awesome project and good answers. I can't stop going through possible pet-projects to try this out soon! :)

link
praveenweb 2894 days ago
> Maybe you could provide some example/tutorial on "stitching your own GraphQL apis with hasura"

We have an example of schema stitching in this repo https://github.com/hasura/graphql-schema-stitching-demo

It stitches a weather API schema and a person schema. Hope it gives an idea.

link
dustingetz 2894 days ago
For "access control layer" to work in the general case we need to be able to code it in a real programming language, no? Or are you going for something one-size-fits-many like Sharepoint?
link