[GraphQL] Updates to Stored Procedure support for Engine
See original GitHub issueSummary
Add a new execute
permission to make it easier to publish stored procedures
Motivation
Supporting Stored Procedure execution via methods other than POST for REST and Queries for GraphQL creates some confusion on how permissions are defined and also it leads to a potential break of best practices regarding the idempotency of non-POST methods.
Functional Specification
To best support Stored Procedure in Data API Builder, we may want to introduce a new action, named execute
that
- can be used only if the published object is a stored procedure
- must be the only action defined in a role
- REST: will be mapped to the POST method by default
- GraphQL: will generate a Mutation by default
Users will be able to decide if they want to use another method other than POST and generating a Query instead of a Mutation by defining their preference using the rest
or graphql
objects that are optionally available withing the entity object. For example:
"GetCowrittenBooksByAuthor": {
"source": {
"type": "stored-procedure",
"object": "dbo.stp_get_all_cowritten_books_by_author",
"parameters": {
"author": "?",
"searchType": "c"
}
},
"graphql":{
"operation": "mutation"
},
"rest": {
"method": ["GET"]
},
"permissions": [
{
"role": "anonymous",
"actions": [ "execute" ]
}
]
}
With this approach we can provide developers the best behaviour by default, but let them decide what is best for them if they need to depart from the best practices for any reasons.
References
[GraphQL] Stored Procedure support for Engine [REST] Update/Create is breaking with Single Permission Support stored procedure Behavior of Update Action for Stored-Procedures in CLI
Issue Analytics
- State:
- Created 8 months ago
- Comments:19 (19 by maintainers)
Top GitHub Comments
Shouldn’t
method
here be an array? To enable multiple methods for the same stored procedure if the developer so chooses?If the developer is explicitly configuring REST method to be GET, and specifies nothing for GraphQL, they will end up in a situation where default is picked for GraphQL which is mutation. If we restrict this, the developer has to modify the config file, to override the default operation for GraphQL to be query, which seems additional overhead if I am only using REST. I dont think we should restrict if they configure incompatible REST/GraphQL operations - the fact that they override the defaults means they understand what they are doing so we rely on what they have specified.