hasura · 0x777 · Feb 13, 2020 · Jan 30, 2020 · Feb 4, 2020 · Feb 4, 2020
@@ -269,13 +269,17 @@ class FilterQuery extends Component {
         >
           <div>
             <div
-              className={`${styles.queryBox} col-xs-6 ${styles.padd_left_remove}`}
+              className={`${styles.queryBox} col-xs-6 ${
+                styles.padd_left_remove
+              }`}
             >
               <span className={styles.subheading_text}>Filter</span>
               {renderWheres(whereAnd, tableSchema, dispatch)}
             </div>
             <div
-              className={`${styles.queryBox} col-xs-6 ${styles.padd_left_remove}`}
+              className={`${styles.queryBox} col-xs-6 ${
+                styles.padd_left_remove
+              }`}
             >
               <b className={styles.subheading_text}>Sort</b>
               {renderSorts(orderBy, tableSchema, dispatch)}

@@ -29,9 +29,11 @@ import           Hasura.GraphQL.Resolve.Mutation
 import           Hasura.GraphQL.Resolve.Select
 import           Hasura.GraphQL.Validate.Field
 import           Hasura.GraphQL.Validate.Types
-import           Hasura.RQL.DML.Insert             (insertCheckExpr)
-import           Hasura.RQL.DML.Internal           (convAnnBoolExpPartialSQL, convPartialSQLExp,
-                                                    dmlTxErrorHandler, sessVarFromCurrentSetting)
+import           Hasura.RQL.DML.Insert             (insertOrUpdateCheckExpr)
+import           Hasura.RQL.DML.Internal           (convPartialSQLExp,
+                                                    convAnnBoolExpPartialSQL, 
+                                                    dmlTxErrorHandler,
+                                                    sessVarFromCurrentSetting)
 import           Hasura.RQL.DML.Mutation
 import           Hasura.RQL.GBoolExp               (toSQLBoolExp)
 import           Hasura.RQL.Types
@@ -50,7 +52,7 @@ data AnnIns a
   = AnnIns
   { _aiInsObj         :: !a
   , _aiConflictClause :: !(Maybe RI.ConflictClauseP1)
-  , _aiCheckCond      :: AnnBoolExpPartialSQL
+  , _aiCheckCond      :: !(AnnBoolExpPartialSQL, Maybe AnnBoolExpPartialSQL)
   , _aiTableCols      :: ![PGColumnInfo]
   , _aiDefVals        :: !(Map.HashMap PGCol S.SQLExp)
   } deriving (Show, Eq, Functor, Foldable, Traversable)
@@ -140,7 +142,7 @@ traverseInsObj rim allColMap (gName, annVal) defVal@(AnnInsObj cols objRels arrR
             dataObj <- asObject dataVal
             annDataObj <- mkAnnInsObj rtRelInfoMap rtColMap dataObj
             ccM <- forM onConflictM $ parseOnConflict rTable rtUpdPerm rtColMap
-            let singleObjIns = AnnIns annDataObj ccM checkCond rtCols rtDefValsRes
+            let singleObjIns = AnnIns annDataObj ccM (checkCond, rtUpdPerm >>= upfiCheck) rtCols rtDefValsRes
                 objRelIns = RelIns singleObjIns relInfo
             return (AnnInsObj cols (objRelIns:objRels) arrRels)
 
@@ -151,7 +153,7 @@ traverseInsObj rim allColMap (gName, annVal) defVal@(AnnInsObj cols objRels arrR
                     dataObj <- asObject arrDataVal
                     mkAnnInsObj rtRelInfoMap rtColMap dataObj
                   ccM <- forM onConflictM $ parseOnConflict rTable rtUpdPerm rtColMap
-                  let multiObjIns = AnnIns annDataObjs ccM checkCond rtCols rtDefValsRes
+                  let multiObjIns = AnnIns annDataObjs ccM (checkCond, rtUpdPerm >>= upfiCheck) rtCols rtDefValsRes
                       arrRelIns = RelIns multiObjIns relInfo
                   return (AnnInsObj cols objRels (arrRelIns:arrRels))
             -- if array relation insert input data has empty objects
@@ -172,7 +174,7 @@ parseOnConflict tn updFiltrM allColMap val = withPathK "on_conflict" $
     case updCols of
       [] -> return $ RI.CP1DoNothing $ Just constraint
       _  -> do
-          UpdPermForIns _ updFiltr preSet <- onNothing updFiltrM $ throw500
+          UpdPermForIns _ _ updFiltr preSet <- onNothing updFiltrM $ throw500
             "cannot update columns since update permission is not defined"
           preSetRes <- mapM (convPartialSQLExp sessVarFromCurrentSetting) preSet
           updFltrRes <- traverseAnnBoolExp
@@ -223,9 +225,9 @@ mkInsertQ
   -> [PGColWithValue]
   -> Map.HashMap PGCol S.SQLExp
   -> RoleName
-  -> AnnBoolExpSQL
+  -> (AnnBoolExpSQL, Maybe AnnBoolExpSQL)
   -> m CTEExp
-mkInsertQ tn onConflictM insCols defVals role checkCond = do
+mkInsertQ tn onConflictM insCols defVals role (insCheck, updCheck) = do
   (givenCols, args) <- flip runStateT Seq.Empty $ toSQLExps insCols
   let sqlConflict = RI.toSQLConflict <$> onConflictM
       sqlExps = mkSQLRow defVals givenCols
@@ -236,7 +238,11 @@ mkInsertQ tn onConflictM insCols defVals role checkCond = do
           . Just
           $ S.RetExp
             [ S.selectStar
-            , insertCheckExpr (toSQLBoolExp (S.QualTable tn) checkCond)
+            , S.Extractor
+                (insertOrUpdateCheckExpr tn onConflictM
+                  (toSQLBoolExp (S.QualTable tn) insCheck)
+                  (fmap (toSQLBoolExp (S.QualTable tn)) updCheck))
+                Nothing
             ]
 
       adminIns = return (CTEExp (S.CTEInsert sqlInsert) args)
@@ -365,9 +371,11 @@ insertObj strfyNum role tn singleObjIns addCols = do
       finalInsCols = cols <> objRelDeterminedCols <> addCols
 
   -- prepare insert query as with expression
-  checkExpr <- convAnnBoolExpPartialSQL sessVarFromCurrentSetting checkCond
-
-  CTEExp cte insPArgs <- mkInsertQ tn onConflictM finalInsCols defVals role checkExpr
+  insCheck <- convAnnBoolExpPartialSQL sessVarFromCurrentSetting insCond
+  updCheck <- traverse (convAnnBoolExpPartialSQL sessVarFromCurrentSetting) updCond
+
+  CTEExp cte insPArgs <-
+    mkInsertQ tn onConflictM finalInsCols defVals role (insCheck, updCheck)
 
   MutateResp affRows colVals <- mutateAndFetchCols tn allCols (cte, insPArgs) strfyNum
   colValM <- asSingleObject colVals
@@ -377,7 +385,7 @@ insertObj strfyNum role tn singleObjIns addCols = do
 
   return (totAffRows, colValM)
   where
-    AnnIns annObj onConflictM checkCond allCols defVals = singleObjIns
+    AnnIns annObj onConflictM (insCond, updCond) allCols defVals = singleObjIns
     AnnInsObj cols objRels arrRels = annObj
 
     arrRelDepCols = flip getColInfos allCols $
@@ -412,7 +420,7 @@ insertMultipleObjects
 insertMultipleObjects strfyNum role tn multiObjIns addCols mutFlds errP =
   bool withoutRelsInsert withRelsInsert anyRelsToInsert
   where
-    AnnIns insObjs onConflictM checkCond tableColInfos defVals = multiObjIns
+    AnnIns insObjs onConflictM (insCond, updCond) tableColInfos defVals = multiObjIns
     singleObjInserts = multiToSingles multiObjIns
     insCols = map _aioColumns insObjs
     allInsObjRels = concatMap _aioObjRels insObjs
@@ -433,10 +441,11 @@ insertMultipleObjects strfyNum role tn multiObjIns addCols mutFlds errP =
         rowsWithCol <- mapM toSQLExps withAddCols
         return $ map (mkSQLRow defVals) rowsWithCol
 
-      checkExpr <- convAnnBoolExpPartialSQL sessVarFromCurrentSetting checkCond
-
-      let insQP1 = RI.InsertQueryP1 tn tableCols sqlRows onConflictM
-                     (Just checkExpr) mutFlds tableColInfos
+      insCheck <- convAnnBoolExpPartialSQL sessVarFromCurrentSetting insCond
+      updCheck <- traverse (convAnnBoolExpPartialSQL sessVarFromCurrentSetting) updCond
+
+      let insQP1 = RI.InsertQueryP1 tn tableCols sqlRows onConflictM 
+                     (insCheck, updCheck) mutFlds tableColInfos
           p1 = (insQP1, prepArgs)
       RI.insertP2 strfyNum p1
 
@@ -480,7 +489,7 @@ convertInsert role tn fld = prefixErrPath fld $ do
       conflictClauseM <- forM onConflictM $ parseOnConflict tn updPerm tableColMap
       defValMapRes <- mapM (convPartialSQLExp sessVarFromCurrentSetting)
                       defValMap
-      let multiObjIns = AnnIns annInsObjs conflictClauseM checkCond
+      let multiObjIns = AnnIns annInsObjs conflictClauseM (checkCond, updPerm >>= upfiCheck)
                           tableCols defValMapRes
           tableCols = Map.elems tableColMap
       strfyNum <- stringifyNum <$> asks getter

@@ -148,14 +148,15 @@ convertUpdateP1 opCtx fld = do
 
   mutFlds <- convertMutResp (_fType fld) $ _fSelSet fld
 
-  pure $ RU.AnnUpd tn updateItems (unresolvedPermFilter, whereExp) mutFlds allCols
+  pure $ RU.AnnUpd tn updateItems (unresolvedPermFilter, whereExp) unresolvedPermCheck mutFlds allCols
   where
     convObjWithOp' = convObjWithOp colGNameMap
     allCols = Map.elems colGNameMap
-    UpdOpCtx tn _ colGNameMap filterExp preSetCols = opCtx
+    UpdOpCtx tn _ colGNameMap filterExp checkExpr preSetCols = opCtx
     args = _fArguments fld
     resolvedPreSetItems = Map.toList $ fmap partialSQLExpToUnresolvedVal preSetCols
     unresolvedPermFilter = fmapAnnBoolExp partialSQLExpToUnresolvedVal filterExp
+    unresolvedPermCheck = maybe annBoolExpTrue (fmapAnnBoolExp partialSQLExpToUnresolvedVal) checkExpr
 
     resolveUpdateOperator operator resolveAction =
       (operator,) <$> withArgM args operator resolveAction

@@ -83,6 +83,7 @@ data UpdOpCtx
   , _uocHeaders    :: ![T.Text]
   , _uocAllCols    :: !PGColGNameMap
   , _uocFilter     :: !AnnBoolExpPartialSQL
+  , _uocCheck      :: !(Maybe AnnBoolExpPartialSQL)
   , _uocPresetCols :: !PreSetColsPartial
   } deriving (Show, Eq)
 
@@ -173,6 +174,7 @@ type RelationInfoMap = Map.HashMap RelName RelInfo
 data UpdPermForIns
   = UpdPermForIns
   { upfiCols   :: ![PGCol]
+  , upfiCheck  :: !(Maybe AnnBoolExpPartialSQL)
   , upfiFilter :: !AnnBoolExpPartialSQL
   , upfiSet    :: !PreSetColsPartial
   } deriving (Show, Eq)

@@ -323,7 +323,7 @@ getRootFldsRole'
   -> [FunctionInfo]
   -> Maybe ([T.Text], Bool) -- insert perm
   -> Maybe (AnnBoolExpPartialSQL, Maybe Int, [T.Text], Bool) -- select filter
-  -> Maybe ([PGColumnInfo], PreSetColsPartial, AnnBoolExpPartialSQL, [T.Text]) -- update filter
+  -> Maybe ([PGColumnInfo], PreSetColsPartial, AnnBoolExpPartialSQL, Maybe AnnBoolExpPartialSQL, [T.Text]) -- update filter
   -> Maybe (AnnBoolExpPartialSQL, [T.Text]) -- delete filter
   -> Maybe ViewInfo
   -> TableConfig -- custom config
@@ -363,13 +363,13 @@ getRootFldsRole' tn primaryKey constraints fields funcs insM
     insCustName = getCustomNameWith _tcrfInsert
     getInsDet (hdrs, upsertPerm) =
       let isUpsertable = upsertable constraints upsertPerm $ isJust viM
-      in ( MCInsert $ InsOpCtx tn $ hdrs `union` maybe [] (\(_, _, _, x) -> x) updM
+      in ( MCInsert $ InsOpCtx tn $ hdrs `union` maybe [] (\(_, _, _, _, x) -> x) updM
          , mkInsMutFld insCustName tn isUpsertable
          )
 
     updCustName = getCustomNameWith _tcrfUpdate
-    getUpdDet (updCols, preSetCols, updFltr, hdrs) =
-      ( MCUpdate $ UpdOpCtx tn hdrs colGNameMap updFltr preSetCols
+    getUpdDet (updCols, preSetCols, updFltr, updCheck, hdrs) =
+      ( MCUpdate $ UpdOpCtx tn hdrs colGNameMap updFltr updCheck preSetCols
       , mkUpdMutFld updCustName tn updCols
       )
 
@@ -517,7 +517,7 @@ mkInsCtx role tableCache fields insPermInfo updPermM = do
     setCols = ipiSet insPermInfo
     checkCond = ipiCheck insPermInfo
     updPermForIns = mkUpdPermForIns <$> updPermM
-    mkUpdPermForIns upi = UpdPermForIns (toList $ upiCols upi)
+    mkUpdPermForIns upi = UpdPermForIns (toList $ upiCols upi) (upiCheck upi)
                           (upiFilter upi) (upiSet upi)
 
     isInsertable Nothing _          = False
@@ -538,7 +538,7 @@ mkAdminInsCtx tc fields = do
       isMutable viIsInsertable viewInfoM && isValidRel relName remoteTable
 
   let relInfoMap = Map.fromList $ catMaybes relTupsM
-      updPerm = UpdPermForIns updCols noFilter Map.empty
+      updPerm = UpdPermForIns updCols Nothing noFilter Map.empty
 
   return $ InsCtx colGNameMap noFilter Map.empty relInfoMap (Just updPerm)
   where
@@ -650,6 +650,7 @@ getRootFldsRole tn pCols constraints fields funcs viM (RolePermInfo insM selM up
     mkUpd u = ( flip getColInfos allCols $ Set.toList $ upiCols u
               , upiSet u
               , upiFilter u
+              , upiCheck u
               , upiRequiredHeaders u
               )
     mkDel d = (dpiFilter d, dpiRequiredHeaders d)
@@ -683,7 +684,7 @@ mkGCtxMapTable tableCache funcCache tabInfo = do
     adminRootFlds =
       getRootFldsRole' tn primaryKey validConstraints fields tabFuncs
       (Just ([], True)) (Just (noFilter, Nothing, [], True))
-      (Just (cols, mempty, noFilter, [])) (Just (noFilter, []))
+      (Just (cols, mempty, noFilter, Nothing, [])) (Just (noFilter, []))
       viewInfo customConfig
 
 noFilter :: AnnBoolExpPartialSQL

@@ -345,9 +345,10 @@ replaceMetadataToOrdJSON ( ReplaceMetadata
         updPermDefToOrdJSON :: Permission.UpdPermDef -> AO.Value
         updPermDefToOrdJSON = permDefToOrdJSON updPermToOrdJSON
           where
-            updPermToOrdJSON (Permission.UpdPerm columns set fltr) =
+            updPermToOrdJSON (Permission.UpdPerm columns set fltr check) =
               AO.object $ [ ("columns", AO.toOrdered columns)
                           , ("filter", AO.toOrdered fltr)
+                          , ("check", AO.toOrdered check)
                           ] <> catMaybes [maybeSetToMaybeOrdPair set]
 
         delPermDefToOrdJSON :: Permission.DelPermDef -> AO.Value

@@ -96,13 +96,13 @@ buildInsPermInfo
   -> FieldInfoMap FieldInfo
   -> PermDef InsPerm
   -> m (WithDeps InsPermInfo)
-buildInsPermInfo tn fieldInfoMap (PermDef _rn (InsPerm chk set mCols) _) =
+buildInsPermInfo tn fieldInfoMap (PermDef _rn (InsPerm checkCond set mCols) _) =
   withPathK "permission" $ do
-    (be, beDeps) <- withPathK "check" $ procBoolExp tn fieldInfoMap chk
+    (be, beDeps) <- withPathK "check" $ procBoolExp tn fieldInfoMap checkCond
     (setColsSQL, setHdrs, setColDeps) <- procSetObj tn fieldInfoMap set
     void $ withPathK "columns" $ indexedForM insCols $ \col ->
            askPGType fieldInfoMap col ""
-    let fltrHeaders = getDependentHeaders chk
+    let fltrHeaders = getDependentHeaders checkCond
         reqHdrs = fltrHeaders `union` setHdrs
         insColDeps = map (mkColDep DRUntyped tn) insCols
         deps = mkParentDep tn : beDeps ++ setColDeps ++ insColDeps
@@ -201,7 +201,12 @@ data UpdPerm
   = UpdPerm
   { ucColumns :: !PermColSpec -- Allowed columns
   , ucSet     :: !(Maybe (ColumnValues Value)) -- Preset columns
-  , ucFilter  :: !BoolExp     -- Filter expression
+  , ucFilter  :: !BoolExp     -- Filter expression (applied before update)
+  , ucCheck   :: !(Maybe BoolExp)     
+  -- ^ Check expression, which must be true after update.
+  -- This is optional because we don't want to break the v1 API
+  -- but Nothing should be equivalent to the expression which always
+  -- returns true.
   } deriving (Show, Eq, Lift, Generic)
 instance Cacheable UpdPerm
 $(deriveJSON (aesonDrop 2 snakeCase){omitNothingFields=True} ''UpdPerm)
@@ -216,9 +221,11 @@ buildUpdPermInfo
   -> FieldInfoMap FieldInfo
   -> UpdPerm
   -> m (WithDeps UpdPermInfo)
-buildUpdPermInfo tn fieldInfoMap (UpdPerm colSpec set fltr) = do
+buildUpdPermInfo tn fieldInfoMap (UpdPerm colSpec set fltr check) = do
   (be, beDeps) <- withPathK "filter" $
     procBoolExp tn fieldInfoMap fltr
+
+  checkExpr <- traverse (withPathK "check" . procBoolExp tn fieldInfoMap) check
 
   (setColsSQL, setHeaders, setColDeps) <- procSetObj tn fieldInfoMap set
 
@@ -227,12 +234,12 @@ buildUpdPermInfo tn fieldInfoMap (UpdPerm colSpec set fltr) = do
        askPGType fieldInfoMap updCol relInUpdErr
 
   let updColDeps = map (mkColDep DRUntyped tn) updCols
-      deps = mkParentDep tn : beDeps ++ updColDeps ++ setColDeps
+      deps = mkParentDep tn : beDeps ++ maybe [] snd checkExpr ++ updColDeps ++ setColDeps
       depHeaders = getDependentHeaders fltr
       reqHeaders = depHeaders `union` setHeaders
       updColsWithoutPreSets = updCols \\ HM.keys setColsSQL
 
-  return (UpdPermInfo (HS.fromList updColsWithoutPreSets) tn be setColsSQL reqHeaders, deps)
+  return (UpdPermInfo (HS.fromList updColsWithoutPreSets) tn be (fst <$> checkExpr) setColsSQL reqHeaders, deps)
 
   where
     updCols     = convColSpec fieldInfoMap colSpec

@@ -228,16 +228,18 @@ updateSelPermFlds refQT rename rn (SelPerm cols fltr limit aggAllwd computedFiel
 updateUpdPermFlds
   :: (MonadTx m, CacheRM m)
   => QualifiedTable -> Rename -> RoleName -> UpdPerm -> m ()
-updateUpdPermFlds refQT rename rn (UpdPerm cols preset fltr) = do
+updateUpdPermFlds refQT rename rn (UpdPerm cols preset fltr check) = do
   updatedPerm <- case rename of
     RTable rt -> do
       let updFltr = updateTableInBoolExp rt fltr
-      return $ UpdPerm cols preset updFltr
+          updCheck = fmap (updateTableInBoolExp rt) check
+      return $ UpdPerm cols preset updFltr updCheck
     RField rf -> do
       updFltr <- updateFieldInBoolExp refQT rf fltr
+      updCheck <- traverse (updateFieldInBoolExp refQT rf) check
       let updCols = updateCols refQT rf cols
           updPresetM = updatePreset refQT rf <$> preset
-      return $ UpdPerm updCols updPresetM updFltr
+      return $ UpdPerm updCols updPresetM updFltr updCheck
   liftTx $ updatePermDefInCatalog PTUpdate refQT rn updatedPerm
 
 updateDelPermFlds