这是indexloc提供的服务，不要输入任何密码
Skip to content

server: refactor GraphQL authorization #5094

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Jun 16, 2020
Merged

server: refactor GraphQL authorization #5094

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
73d1039
initial commit for GQL API system authorization
ecthiender Jun 5, 2020
9ff4d71
add required modules to exposed-modules
ecthiender Jun 8, 2020
ca4799c
fix hlint warnings
ecthiender Jun 8, 2020
ca5d7ac
rename to MonadGQLAuthorization
ecthiender Jun 11, 2020
4a92797
Merge branch 'master' into gql-authorization
ecthiender Jun 12, 2020
5d6fdfc
fix comments
ecthiender Jun 15, 2020
92ae24c
move ip address related code to Network.Wai.Extended
0x777 Jun 15, 2020
1fc38ee
move authorizeGQLApi inside runGQ
ecthiender Jun 16, 2020
3213948
Merge branch 'gql-authorization' of github.com:ecthiender/graphql-eng…
ecthiender Jun 16, 2020
40a1289
rename GQLAuthorization to GQLExecutionCheck
0x777 Jun 16, 2020
25b8fef
explain queries need not be checked against allowlist
0x777 Jun 16, 2020
c3b0e13
improve naming, documentation
0x777 Jun 16, 2020
013186b
minimize diff
0x777 Jun 16, 2020
4691db3
add comments
0x777 Jun 16, 2020
80b1e18
Merge branch 'master' into gql-authorization
0x777 Jun 16, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 18 additions & 10 deletions server/graphql-engine.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,21 +241,36 @@ library
, Hasura.Server.Migrate
, Hasura.Server.Compression
, Hasura.Server.API.PGDump
-- exposed for Pro
, Hasura.Server.API.Config
, Hasura.Server.Telemetry

-- Exposed for testing:
, Hasura.Server.Telemetry.Counters
, Data.Parser.JSONPath
, Hasura.Server.Auth.JWT

-- exposed for Pro
, Hasura.GraphQL.Execute
, Hasura.GraphQL.Execute.LiveQuery
, Hasura.GraphQL.Validate
, Hasura.GraphQL.Transport.HTTP
, Hasura.GraphQL.Transport.WebSocket.Protocol
, Hasura.GraphQL.Transport.WebSocket.Server

, Hasura.RQL.Types
, Hasura.RQL.Types.Run
, Hasura.RQL.DDL.Metadata
, Hasura.RQL.DDL.Metadata.Types
, Hasura.RQL.DDL.Metadata.Generator
, Hasura.RQL.DDL.Schema
-- required for buildRebuildableSchemaCache and runCacheRWT to be exposed
, Hasura.RQL.DDL.Schema.Cache
, Hasura.EncJSON
, Hasura.Session

, Data.Aeson.Ordered
, Data.TByteString

other-modules: Hasura.Incremental.Select
, Hasura.Incremental.Internal.Cache
Expand All @@ -265,9 +280,7 @@ library
, Hasura.Server.Auth.WebHook
, Hasura.Server.Middleware
, Hasura.Server.CheckUpdates
, Hasura.Server.Telemetry
, Hasura.Server.SchemaUpdate
, Hasura.Server.API.Config
, Hasura.Server.Migrate.Version
, Hasura.Server.Auth.JWT.Internal
, Hasura.Server.Auth.JWT.Logging
Expand Down Expand Up @@ -301,7 +314,6 @@ library
, Hasura.RQL.DDL.Permission
, Hasura.RQL.DDL.Relationship.Rename
, Hasura.RQL.DDL.Relationship.Types
, Hasura.RQL.DDL.Schema.Cache
, Hasura.RQL.DDL.Schema.Cache.Common
, Hasura.RQL.DDL.Schema.Cache.Dependencies
, Hasura.RQL.DDL.Schema.Cache.Fields
Expand Down Expand Up @@ -336,9 +348,6 @@ library
, Hasura.RQL.GBoolExp

, Hasura.GraphQL.Transport.HTTP.Protocol
, Hasura.GraphQL.Transport.HTTP
, Hasura.GraphQL.Transport.WebSocket.Protocol
, Hasura.GraphQL.Transport.WebSocket.Server
, Hasura.GraphQL.Transport.WebSocket
, Hasura.GraphQL.Schema.BoolExp
, Hasura.GraphQL.Schema.Common
Expand All @@ -357,16 +366,13 @@ library
, Hasura.GraphQL.RelaySchema
, Hasura.GraphQL.Utils
, Hasura.GraphQL.NormalForm
, Hasura.GraphQL.Validate
, Hasura.GraphQL.Validate.Types
, Hasura.GraphQL.Validate.Context
, Hasura.GraphQL.Validate.SelectionSet
, Hasura.GraphQL.Validate.InputValue
, Hasura.GraphQL.Explain
, Hasura.GraphQL.Execute
, Hasura.GraphQL.Execute.Plan
, Hasura.GraphQL.Execute.Query
, Hasura.GraphQL.Execute.LiveQuery
, Hasura.GraphQL.Execute.LiveQuery.Options
, Hasura.GraphQL.Execute.LiveQuery.Plan
, Hasura.GraphQL.Execute.LiveQuery.Poll
Expand Down Expand Up @@ -397,7 +403,6 @@ library
, Data.HashMap.Strict.Extended
, Data.HashMap.Strict.InsOrd.Extended
, Data.Sequence.NonEmpty
, Data.TByteString
, Data.Text.Extended
, Data.Parser.Expires

Expand All @@ -408,7 +413,10 @@ library
, Hasura.SQL.Time
, Hasura.SQL.Types
, Hasura.SQL.Value

, Network.URI.Extended
, Network.Wai.Extended
, Network.Wai.Handler.WebSockets.Custom

executable graphql-engine
import: common-all, common-exe
Expand Down
95 changes: 56 additions & 39 deletions server/src-lib/Hasura/App.hs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,55 +1,57 @@
{-# LANGUAGE RecordWildCards #-}
{-# LANGUAGE UndecidableInstances #-}

module Hasura.App where

import Control.Concurrent.STM.TVar (readTVarIO)
import Control.Concurrent.STM.TVar (readTVarIO)
import Control.Monad.Base
import Control.Monad.Catch (MonadCatch, MonadThrow, onException)
import Control.Monad.Catch (MonadCatch, MonadThrow, onException)
import Control.Monad.Stateless
import Control.Monad.STM (atomically)
import Control.Monad.Trans.Control (MonadBaseControl (..))
import Data.Aeson ((.=))
import Data.Time.Clock (UTCTime)
import Control.Monad.STM (atomically)
import Control.Monad.Trans.Control (MonadBaseControl (..))
import Data.Aeson ((.=))
import Data.Time.Clock (UTCTime)
import GHC.AssertNF
import Options.Applicative
import System.Environment (getEnvironment, lookupEnv)
import System.Exit (exitFailure)

import qualified Control.Concurrent.Async as Async
import qualified Control.Concurrent.Async.Lifted.Safe as LA
import qualified Control.Concurrent.Extended as C
import qualified Data.Aeson as A
import qualified Data.ByteString.Char8 as BC
import qualified Data.ByteString.Lazy.Char8 as BLC
import qualified Data.Set as Set
import qualified Data.Text as T
import qualified Data.Time.Clock as Clock
import qualified Data.Yaml as Y
import qualified Database.PG.Query as Q
import qualified Network.HTTP.Client as HTTP
import qualified Network.HTTP.Client.TLS as HTTP
import qualified Network.Wai.Handler.Warp as Warp
import qualified System.Log.FastLogger as FL
import qualified Text.Mustache.Compile as M
import System.Environment (getEnvironment, lookupEnv)
import System.Exit (exitFailure)

import qualified Control.Concurrent.Async as Async
import qualified Control.Concurrent.Async.Lifted.Safe as LA
import qualified Control.Concurrent.Extended as C
import qualified Data.Aeson as A
import qualified Data.ByteString.Char8 as BC
import qualified Data.ByteString.Lazy.Char8 as BLC
import qualified Data.Set as Set
import qualified Data.Text as T
import qualified Data.Time.Clock as Clock
import qualified Data.Yaml as Y
import qualified Database.PG.Query as Q
import qualified Network.HTTP.Client as HTTP
import qualified Network.HTTP.Client.TLS as HTTP
import qualified Network.Wai.Handler.Warp as Warp
import qualified System.Log.FastLogger as FL
import qualified Text.Mustache.Compile as M

import Hasura.Db
import Hasura.EncJSON
import Hasura.Eventing.EventTrigger
import Hasura.Eventing.ScheduledTrigger
import Hasura.GraphQL.Resolve.Action (asyncActionsProcessor)
import Hasura.GraphQL.Execute (MonadGQLExecutionCheck (..),
checkQueryInAllowlist)
import Hasura.GraphQL.Resolve.Action (asyncActionsProcessor)
import Hasura.GraphQL.Transport.HTTP.Protocol (toParsed)
import Hasura.Logging
import Hasura.Prelude
import Hasura.RQL.Types (CacheRWM, Code (..), HasHttpManager,
HasSQLGenCtx, HasSystemDefined, QErr (..),
SQLGenCtx (..), SchemaCache (..), UserInfoM,
buildSchemaCacheStrict, decodeValue,
throw400, withPathK)
import Hasura.RQL.Types (CacheRWM, Code (..), HasHttpManager,
HasSQLGenCtx, HasSystemDefined, QErr (..),
SQLGenCtx (..), SchemaCache (..),
UserInfoM, buildSchemaCacheStrict,
decodeValue, throw400, withPathK)
import Hasura.RQL.Types.Run
import Hasura.Server.API.Query (requiresAdmin, runQueryM)
import Hasura.Server.API.Query (requiresAdmin, runQueryM)
import Hasura.Server.App
import Hasura.Server.Auth
import Hasura.Server.CheckUpdates (checkForUpdates)
import Hasura.Server.CheckUpdates (checkForUpdates)
import Hasura.Server.Init
import Hasura.Server.Logging
import Hasura.Server.SchemaUpdate
Expand Down Expand Up @@ -195,7 +197,7 @@ newShutdownLatch = fmap ShutdownLatch C.newEmptyMVar
waitForShutdown :: ShutdownLatch -> IO ()
waitForShutdown = C.takeMVar . unShutdownLatch

-- | Initiate a graceful shutdown of the server associated with the provided
-- | Initiate a graceful shutdown of the server associated with the provided
-- latch.
shutdownGracefully :: InitCtx -> IO ()
shutdownGracefully = flip C.putMVar () . unShutdownLatch . _icShutdownLatch
Expand All @@ -205,11 +207,13 @@ runHGEServer
, MonadIO m
, MonadCatch m
, MonadStateless IO m
, LA.Forall (LA.Pure m)
, UserAuthentication m
, MetadataApiAuthorization m
, HttpLog m
, ConsoleRenderer m
, LA.Forall (LA.Pure m)
, MonadGQLExecutionCheck m
, MonadConfigApiHandler m
)
=> ServeOptions impl
-> InitCtx
Expand Down Expand Up @@ -286,7 +290,8 @@ runHGEServer ServeOptions{..} InitCtx{..} initTime = do
runCronEventsGenerator logger _icPgPool (getSCFromRef cacheRef)

-- start a background thread to deliver the scheduled events
void $ liftIO $ C.forkImmortal "processScheduledTriggers" logger $ processScheduledTriggers logger logEnvHeaders _icHttpManager _icPgPool (getSCFromRef cacheRef)
void $ liftIO $ C.forkImmortal "processScheduledTriggers" logger $
processScheduledTriggers logger logEnvHeaders _icHttpManager _icPgPool (getSCFromRef cacheRef)

-- start a background thread to check for updates
_updateThread <- C.forkImmortal "checkForUpdates" logger $ liftIO $
Expand Down Expand Up @@ -362,10 +367,10 @@ runHGEServer ServeOptions{..} InitCtx{..} initTime = do
-- | Waits for the shutdown latch 'MVar' to be filled, and then
-- shuts down the server and associated resources.
-- Structuring things this way lets us decide elsewhere exactly how
-- we want to control shutdown.
-- we want to control shutdown.
shutdownHandler :: Loggers -> IO () -> EventEngineCtx -> Q.PGPool -> IO () -> IO ()
shutdownHandler (Loggers loggerCtx (Logger logger) _) shutdownApp eeCtx pool closeSocket =
void . Async.async $ do
void . Async.async $ do
waitForShutdown _icShutdownLatch
logger $ mkGenericStrLog LevelInfo "server" "gracefully shutting down server"
shutdownEvents pool (Logger logger) eeCtx
Expand Down Expand Up @@ -430,6 +435,18 @@ instance ConsoleRenderer AppM where
renderConsole path authMode enableTelemetry consoleAssetsDir =
return $ mkConsoleHTML path authMode enableTelemetry consoleAssetsDir

instance MonadGQLExecutionCheck AppM where
checkGQLExecution userInfo _ enableAL sc query = runExceptT $ do
req <- toParsed query
checkQueryInAllowlist enableAL userInfo req sc
return req

instance MonadConfigApiHandler AppM where
runConfigApiHandler = configApiGetHandler


--- helper functions ---

mkConsoleHTML :: HasVersion => Text -> AuthMode -> Bool -> Maybe Text -> Either String Text
mkConsoleHTML path authMode enableTelemetry consoleAssetsDir =
renderHtmlTemplate consoleTmplt $
Expand Down
Loading