Disable GraphQL Query and Subscription Root Fields selectively with RBAC
Tags: graphql
Published: 2022-09-14 07:04:10

---
title: Disable GraphQL Query and Subscription Root Fields selectively with RBAC
published: true
date: 2022-09-05 12:54:12 UTC
tags: graphql
canonical_url: https://hasura.io/blog/disable-query-subscription-root-fields-in-hasura/
---

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/rbac_root_fields.png)

For each database table in a Hasura app, the GraphQL engine creates three root fields by default. Assuming there is a `note` table, the three root fields would be:

1. note
2. note\_by\_pk
3. note\_aggregate

However, there are use cases where you might want to expose only certain root fields or none at all. For example, you might want to hide `note_aggregate`, expose only `note_by_pk`, or hide all of them. Now it's possible to do that.

> Hasura launched this feature in the v2.8.0 version. You can check the v2.8.0 changelog [here](https://github.com/hasura/graphql-engine/releases/tag/v2.8.0).

In the next step, you will build and use a Hasura application to test the different use cases.

## Try it out via Hasura

The Hasura application you will build is a basic note-taking app. Users can add multiple notes, whereas each note belongs to only one user.

The quickest way to use Hasura is via the Hasura Cloud. Create a new Hasura project and launch the console.

[![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://camo.githubusercontent.com/949a2db267b00f49757865d585f16687118d796d41064e21c3d933d21884d533/68747470733a2f2f6772617068716c2d656e67696e652d63646e2e6861737572612e696f2f696d672f6465706c6f795f746f5f6861737572612e706e67)](https://cloud.hasura.io/signup)

Note: If you prefer local development using Docker, check out the documentation on [getting started with Docker](https://hasura.io/docs/latest/getting-started/docker-simple/).

After that, connect the Hasura application to a database and create two tables - `user` and `note`.

The `user` table has the following columns:

- `id` of type UUID (PK)
- `name` of type Text

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/create-user-table-hasura.png)

The `note` table has the following columns:

- `id` of type UUID (PK)
- `title` of type Text
- `content` of type Text
- `author_id` of type Text

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/create-note-table-hasura.png)

The next step involves creating the relationships between the two tables. Navigate to the "Permissions" tab in the `user` table and create an array relationship between the `user` and `note` tables.

The `id` column from the `user` table maps to the `author_id` column from the `note` table.

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/user-note-relationship.png)

Similarly, create an object relationship between the `note` and `user` table. The `author_id` column from the `note` table maps to the `id` column from the `user` table.

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/note-user-relationship.png)

You finished configuring the application! Add some data (users and notes) to the application so you can test the different use cases.

### How to use the feature

It's important to mention that you can disable query/subscription root fields only through the metadata file. You need to export and import metadata whenever you want to customize the root fields.

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/export-metadata-hasura.png)

You will export the metadata file, make the corresponding changes and then upload the metadata file to Hasura.

**Note**: An alternative way of managing the metadata is to use the Hasura command-line interface (CLI). The documentation covers the [hasura metadata](https://hasura.io/docs/latest/hasura-cli/commands/hasura_metadata/) in detail.

The console support will come soon too!

### Use case: Disable GraphQL operations

The feature allows you to disable a specific GraphQL operation (queries or subscriptions) or all of them. You can grant a role to make queries, but not subscriptions, and vice-versa. Or you can disallow both.

Using the example Hasura application, you can disable all the root fields of the `user` table for the `guest` role as follows:

```
{
   "role": "guest",
   "permission": {
     "columns": [
       "id",
       "title",
       "content",
       "author_id"
     ],
     "filter": {},
     "allow_aggregations": true,
     "query_root_fields": [],
     "subscription_root_fields": []
   }
}

```

The empty arrays from the last two fields indicate that no root fields should be displayed for the `user` table.

The image illustrates what you should see after applying the permissions.

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/disable-operations-hasura.png)

⚠️ It's important to note that the `guest` role can still indirectly access the `user` table through the `notes` relationship.

```
query {
  note {
    id
    title
    content
    author_id
    author {
      id
      name
    }
  }
}

```

If you run the above query, you will see the author details for each note. Keep this in mind when disabling direct access to a table.

You can see the complete metadata code for this use case in [this Gist](https://gist.github.com/catalinpit/741ad91e9b407927699cf092e8344ec3).

## Use case: Primary key access only

Another use case would be to access the table only through its primary key. The client can only fetch data from the table if the client knows the primary key of a particular row.

Add the following permissions to the `note` table in the metadata file:

```
{
  "role": "guest",
  "permission": {
    "columns": [
      "author_id",
      "content",
      "title",
      "id"
    ],
    "filter": {},
    "query_root_fields": ["select_by_pk"],
    "subscription_root_fields": ["select_by_pk"]
  }
}

```

After you import the updated metadata file, the `guest` role should only have access to the `note_by_pk` root field, as shown in the image below.

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/by-pk-root-fields.png)

You can see the complete metadata code for this use case in [this Gist](https://gist.github.com/catalinpit/8aa5d57b81a4c2d4f7b2340d407cb8f5).

## Use case: Access table through a relationship

The last scenario from this post involves providing indirect access to a table. That means accessing a table through a relationship.

In this application example, you could make the `user` table accessible only through the `notes` relationship.

Go to the metadata file and apply the following permissions for the `user` table:

```
{
  "role": "guest",
  "permission": {
    "columns": [
      "id", 
      "name"],
    "filter": {},
    "query_root_fields": [],
    "subscription_root_fields": []
  }
}

```

If you go to the Hasura console and perform the [query shown in the image](https://gist.github.com/catalinpit/04ec032c322129b5d9ae026f2d4b3292), you should be able to access the rows from the `user` table.

![Disable GraphQL Query and Subscription Root Fields selectively with RBAC](https://hasura.io/blog/content/images/2022/09/indirect-table-access-hasura.png)

You can see the complete metadata code for this use case in [this Gist](https://gist.github.com/catalinpit/16a3065df155f35328e20bc3f159192a).

## Summary

The feature allows you to disable root fields and customize your GraphQL API. You can disable queries, subscriptions, or both of them. It also allows you to make tables accessible only through a relationship.

There is also a video that talks about hiding root fields.

{% youtube nOjz1E6XTjo %}