This is the same use case as raised by andrewklau in the discord on 12/12/2018.

Hasura Discord:

andrewklau12/12/2018
Is there a way to allow select lookups but not lists?

Vamshi Surabhi12/12/2018
@andrewklau Can you elaborate?

andrewklau12/12/2018
if I have a "users" table, I want to be able to select by uuid but not allow to list all the users

Vamshi Surabhi12/12/2018
@andrewklau Hmm. Interesting. Would whitelisting queries solve this for you? You would whitelist such a query and only the user_id will be allowed to change.

query q ($user_id: uuid!) {
  user(where: {uuid: {_eq: $user_id}}) {
    id
  }
}

#989

andrewklau12/12/2018
@vamshi Surabhi hmm, yeh that would. I did see there was an option to limit the number of rows returned. I guess that would solve the same thing (ie. limit rows to 1)

Vamshi Surabhi12/12/2018
@andrewklau Oh yeah. That should also work.

shahidhk12/12/2018
@andrewklau If you've defined permissions based on user id, even a select on user table (without where clause) will return only 1 row, i.e the matching ones only. Just FYI, not sure about your use case here

Query whitelisting #989

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions