Allow overriding the request role via a GraphQL directive

As mentioned on Discord, it isn’t possible to change the role used by an existing websocket connection, since X-Hasura-Role is sent as a header when opening the connection. @0x777 suggests allowing a special @hasura(role:) directive on a GraphQL operation definition, like this:

subscription s @hasura(role: "new-role") {
  vote_count {
    article_id
    count
  }
}

This would override the role that would otherwise be used for that particular request.

[0x777]

A user can have multiple roles and each role could have different permissions on different tables, in such cases, you would want to make a query by specifying the appropriate role (since we don’t support multiple roles). On http, you can set x-hasura-role to the appropriate role and make the request but this feature is lacking on the ws transport as the role gets set when the connection is initialized.

[GavinRay97]

The last bit you posted is great, because the function/data structure is recursive. So we can generate it like this:

const makeRoleLink = (role) =>
  new WebSocketLink({
    uri: 'ws://localhost:8080/v1/graphql',
    options: {
      reconnect: true,
      connectionParams: {
        headers: { 'x-hasura-role': role },
      },
    },
  })

const composeRoleLinks = (head, ...tail) => {
  const [newHead, ...newTail] = [...tail].flat()

  return ApolloLink.split(
    (operation) => operation.getContext().role === head,
    /* ? */ makeRoleLink(head),
    /* : */ newTail.length > 0
      ? composeRoleLinks(newHead, newTail)
      : makeRoleLink(newHead)
  )
}

// Or, more likely coming from `X-Hasura-Allowed-Roles`
const roleLinks = composeRoleLinks('first', 'second', 'third', 'etc.')

const client = new ApolloClient({
  link: roleLinks,
  cache: new InMemoryCache(),
})