Excluding columns from entities by default (without permissions)

[akamud]

I see I can exclude columns for specific permissions definitions, but is there a way to exclude columns (or explicitly define the included columns) for entities by default?

My goal with this is to make sure a new permission doesn't accidentally expose a sensitive column by using include: ["*"], which is possible at the moment, from my understanding. If I could define the array of columns that should be exposed by an entity, the * would mean a subset of the allowed columns.

[seantleonard]

To make sure I'm understanding your ask: You'd like to see the ability to explicitly define a default set of columns (per entity) that are represented when the * wildcard is used?

• We don't support that at the moment. Though, which seems to be the purpose of raising this issue, the manual workaround would be explicitly listing out columns in the include: ["col1","col2","colN"], which would end up making config pretty verbose.

[akamud]

To make sure I'm understanding your ask: You'd like to see the ability to explicitly define a default set of columns (per entity) that are represented when the * wildcard is used?

• We don't support that at the moment. Though, which seems to be the purpose of raising this issue, the manual workaround would be explicitly listing out columns in the include: ["col1","col2","colN"], which would end up making config pretty verbose.

The * wildcard bit would be an improvement.

What I want to do now is simply being able to restrict columns on entity level. Imagine I'm exposing an Entity User, and later a new column Age is added to my database with sensitive information, I don't want to accidentally expose this new column. The only way to achieve this is to have a permission like read where I use the include property, correct?

What I would like to do is to have this definition on the entity level, not on the permission level. Is this possible?

[seantleonard]

The only way to achieve this is to have a permission like read where I use the include property, correct?

That's correct. Using the include property and listing out columns would be the only way to prevent exposing columns added in the future.

What I would like to do is to have this definition on the entity level, not on the permission level. Is this possible?

That is not possible today. Would this hypothetical example capture what you would like to see?

• Entity level property such as "defaultcolumns": ["col1","col2","colN"] whose columns "col1","col2", and "colN" would be substituted into:
  • Locations where the wildcard * is used. e.g. the Read and Update actions in the role ImportantRole
  • Locations where the wildcard is implied, e.g. actions in the Authenticated role below. (Because no include/exclude properties are set, wildcard for Include is implied)

"entities": {
    "Publisher": {
      "source": "publishers",
      "defaultcolumns": ["col1","col2","colN"],
      "permissions": [
        {
          "role": "authenticated",
          "actions": [ "create", "read", "update", "delete" ]
        },
        {
          "role": "ImportantRole",
          "actions": [
            {
              "action": "Read",
              "fields": { "include": [ "*" ] }
            },
            {
              "action": "Update",
              "fields": { "include": [ "*" ] }
            },
            "Create",
            "Delete"
          ]
        }
      ],
      "rest": true,
      "graphql": true
    }

[akamud]

Thanks for clarifying my first question.

Yes, that example would make sense. If I can suggest a minor change, having includedColumns and excludedColumns following the same semantics we have today in the permissions.actions.fields would be better.

The rules you suggested for "merging" the fields rules with the *Columns would be the same as you described, but having included/excludedColumns semantics would give more freedom for defining them.