How to automatically generate allow-lists from a JS/TS codebase?

[dminkovsky]

I would like to use allow-lists, but entering them to Hasura by hand does not seem feasible. Has anyone explored any automated methods? I am thinking something that scans my code for gql tags (I am using Apollo Client) and produces an allow list.

[dminkovsky]

Looks like apollo-tool's client:extract will do the job. Can be paired with a script that pushes to the metadata API to fully automate, or can be uploaded to Hasura by hand.

[dminkovsky]

@msimon cool, thanks again for posting and for the update. Would love to see what you come up with. My bandwidth is totally saturated right now, but this will be important to me soon.

[msimon]

@dminkovsky push to my repo.

I added the option -v, --version <version> that allows several versions. Once it finds an updated query, it will create a new version of it. At the moment, it never deletes anything.
So some kind of manual cleanup is necessary. I may add automatic cleanup as an option later if needed. Maybe based on the number of days or list of supported versions.

I personally using it this way:

yarn dev -h http://localhost:8080 -s local_admin_secret -p '../../frontend/**/*.graphql' -v ${GIT_VERSION}

This will create allow list that respect this format: ($NAME__($TIMESTAMP_$VERSION). loggedUser___(1624536406478-0dfe607)

[dminkovsky]

Thank you so much for sharing, Marc. I will definitely have a look when I get to this.

[dminkovsky]

I wonder what the performance implications of the allow-list are, especially of there are many queries. I really wish Hasura had hashed/persisted queries.

[msimon]

I haven't checked their code, but I would not be surprised it's a hash.
The allow-list queries are stored in memory into their metadata, and they have to match exactly. Even parameters order is required.
So it's really just a plain string comparison, which is certainly very fast.

[msimon]

@dminkovsky I ended up packaging and releasing it on my own as it does not seems like TallerWebSolutions is active anymore.
You can find the updated doc here: https://github.com/HomeskilletHealthInc/hasura-allow-list-manager
and package here: https://www.npmjs.com/package/@homeskillet/hasura-allow-list-manager

I have been using for several deployment so far, and it works very well :)

[dminkovsky]

Oh well yeah I would think you could do versioning by checking in the generated allow-lists that are generated by this tool, or something like that?

[dminkovsky]

Of course not breaking old clients is a huge consideration...

[msimon]

Oh well yeah I would think you could do versioning by checking in the generated allow-lists that are generated by this tool, or something like that?

Mmm I don't know how that would work. Last time I check, you could only set the allow-list file at once.
So if you have versioning, i think you'll have to add it to this file your uploading. Maybe Hasura's api change since then though

[dminkovsky]

My bad I haven't still actually used allowed-lists so I was a bit confused about them. I just looked at the docs and I see what you mean. I'll try this plugin out because I'm using this codegen util already (it's really nice, generates TypePolicies for example!), and I'll update here about how versioning works (or does not work :))

[dminkovsky]

Oh and by the way, looks like the other answer is this plugin.

[BenoitRanque]

We have released a plugin for graphql codegen that allows you to generate the metadata file you need for this.
You can find the pull request at dotansimha/graphql-code-generator#7476
If this is a feature you'd like, please show support on the issue so it gets accepted! Also interested to hear any feedback.

[dminkovsky]

I came here to post this :) https://www.graphql-code-generator.com/plugins/other/hasura-allow-list. Awesome!

[dminkovsky]

@praveenweb this should be the accepted answer?