hasura · tirumaraiselvan · Sep 7, 2020 · Sep 7, 2020 · Sep 7, 2020 · Sep 7, 2020
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Breaking change
 
-Headers from environment variables starting with `HASURA_GRAPHQL_` are not allowed  
+Headers from environment variables starting with `HASURA_GRAPHQL_` are not allowed
 in event triggers, actions & remote schemas.
 
 If you do have such headers configured, then you must update the header configuration before upgrading.
@@ -21,6 +21,7 @@ If you do have such headers configured, then you must update the header configur
 - server: add logs for action handlers
 - server: add request/response sizes in event triggers (and scheduled trigger) logs (#5463)
 - server: change startup log kind `db_migrate` to `catalog_migrate` (#5531)
+- server: fixes select permission in computed fields regression (fixes #5696)
 - console: handle nested fragments in allowed queries (close #5137) (#5252)
 - console: update sidebar icons for different action and trigger types (#5445)
 - console: make add column UX consistent with others (#5486)

@@ -546,7 +546,9 @@ getSelPerm tableCache fields roleName selPermInfo = do
           inputArgSeq = mkComputedFieldFunctionArgSeq $ _cffInputArgs function
       fmap (SFComputedField . ComputedField name function inputArgSeq) <$>
         case returnTy of
-          CFRScalar scalarTy  -> pure $ Just $ CFTScalar scalarTy
+          CFRScalar scalarTy  ->
+            pure $ bool Nothing (Just $ CFTScalar scalarTy) $
+              name `Set.member` spiScalarComputedFields selPermInfo
           CFRSetofTable retTable -> do
             retTableInfo <- getTabInfo tableCache retTable
             let retTableSelPermM = getSelPermission retTableInfo roleName

@@ -1,28 +1,73 @@
-description: Query author with computed fields as user role
-url: /v1/graphql
-status: 200
-headers:
-  X-Hasura-Role: user
-  X-Hasura-User-Id: '1'
-query:
-  query: |
-    query {
-      author{
-        full_name
-        get_articles(args:{search:"Article"}){
+- description: Query author with computed fields as user role
+  url: /v1/graphql
+  status: 200
+  headers:
+    X-Hasura-Role: user
+    X-Hasura-User-Id: '1'
+  query:
+    query: |
+      query {
+        author{
+          full_name
+          get_articles(args:{search:"Article"}){
+            id
+            title
+            content
+            author_id
+          }
+        }
+      }
+  response:
+    data:
+      author:
+      - full_name: Roger Chris
+        get_articles:
+        - id: 1
+          title: Article 1
+          content: Content for Article 1
+          author_id: 1
+
+- description: Query author with computed fields as public role
+  url: /v1/graphql
+  status: 200
+  headers:
+    X-Hasura-Role: public_role
+  query:
+    query: |
+      query {
+        author{
+          full_name
           id
           title
-          content
-          author_id
         }
       }
-    }
-response:
-  data:
-    author:
-    - full_name: Roger Chris
-      get_articles:
-      - id: 1
-        title: Article 1
-        content: Content for Article 1
-        author_id: 1
+  response:
+    errors:
+      - extensions:
+          path: $.selectionSet.author.selectionSet.full_name
+          code: validation-failed
+        message: "field \"full_name\" not found in type: 'author'"
+
+- description: Query author with computed fields as public role
+  url: /v1/graphql
+  status: 200
+  headers:
+    X-Hasura-Role: public_role
+  query:
+    query: |
+      query {
+        author{
+          get_articles(args:{search:"Article"}){
+            id
+            title
+            content
+          }
+        }
+      }
+  response:
+    errors:
+      - extensions:
+          path: $.selectionSet.author.selectionSet.get_articles.selectionSet.id
+          code: validation-failed
+       # the "public_role" role doesn't have access to "id" field
+        message: "field \"id\" not found in type: 'article'"
@@ -136,6 +136,27 @@ args:
       computed_fields:
       - full_name
 
+- type: create_select_permission
+  args:
+    table: author
+    role: public_role
+    permission:
+      columns:
+        - first_name
+        - last_name
+      filter: {}
+      computed_fields: []
+
+- type: create_select_permission
+  args:
+    table: article
+    role: public_role
+    permission:
+      columns:
+        - title
+        - content
+      filter: {}
+
 - type: track_table
   args:
     name: locations