feat(gb-9000): provide configuration to enable/disable queries or mutations

Author: pimeys

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "grafbase-postgres"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2024"
 license = "Apache-2.0"
 

cli/postgres/Cargo.toml

@@ -106,22 +106,103 @@ default_schema = "public"
 # maps to a Postgres database name in your gateway configuration.
 # Defaults to "default" if you don't specify it
 database_name = "default"
+
+# Enable mutations (write operations) globally for the whole database.
+# Defaults to true if you omit this setting.
+enable_mutations = true
+
+# Enable queries (read operations) globally for the whole database.
+# Defaults to true if you omit this setting.
+enable_queries = true
+
+# Configure schemas for this database. Key-value from schema name to configuration.
+schemas = {}
+```
+
+### Schema Configuration
+
+```toml
+[schemas.public]
+
+# Enable mutations (write operations) globally for the whole schema.
+# Takes precedence over the global setting. Defaults to true if you omit this setting.
+enable_mutations = true
+
+# Enable queries (read operations) globally for the whole database.
+# Takes precedence over the global setting. Defaults to true if you omit this setting.
+enable_queries = true
+
+# Configure views for this schema.
+views = {}
+
+# Configure tables for this schema. Key-value from table name to configuration.
+tables = {}
 ```
 
-### Exposing Views
+### Table Configuration
+
+```toml
+[schemas.public.tables.users]
+
+# Enable mutations (write operations) for the table.
+# Takes precedence over the global and schema settings.
+# Defaults to true if you omit this setting.
+enable_mutations = true
+
+# Enable queries (read operations) for the table.
+# Takes precedence over the global and schema settings.
+# Defaults to true if you omit this setting.
+enable_queries = true
+
+# Table relations are always calculated from the database foreign keys.
+# In cases like with table to view relations this is not possible, and
+# you can define them manually from this map. Key/value from relation name
+# to config.
+relations = {}
+```
+
+### View Configuration
 
 PostgreSQL views require additional configuration because the information schema doesn't provide details about unique constraints, nullability, or relations. To make a view visible in your GraphQL SDL, you must define at least one unique key.
 
+```toml
+[schemas.public.views.restricted_users]
+
+# Enable queries (read operations) for the the view.
+# Takes precedence over the global and schema settings.
+# Defaults to true if you omit this setting.
+enable_queries = true
+
+# Even if the underlying table has unique constraints, the database does not
+# show them for the view presenting the data. Single column keys you can configure
+# better through the columns map, but use this for compound keys.
+# An array of arrays. Each array is a collection of columns forming the key. Order
+# of the columns matter.
+unique_keys = []
+
+# The database does not have information on the nullability, or uniqueness
+# of view columns. You can define column settings manually from this map.
+# Key/value from column name to config.
+columns = {}
+
+# Views do not have foreign keys mapped to them, as tables do. You
+# can define relations manualy from this map.
+# Key/value from relation name to config.
+relations = {}
+```
+
 #### Unique Key Definitions
 
 ```toml
 [schemas.public.views.my_view]
+
 # The order of columns matters - match the order in the underlying query/table.
 # Define compound keys like this:
 unique_keys = [["user_name", "user_id"]]
 
 # structure: schemas.<schema_name>.views.<view_name>.columns.<column_name>
 [schemas.public.views.my_view.columns.user_name]
+
 # Defaults to true if you omit this setting
 nullable = false
 # Define a single-column unique key here. Defaults to false if omitted.
@@ -142,6 +223,7 @@ The introspection will fail if you reference any non-existent schemas, views, or
 ```toml
 # structure: schemas.<schema_name>.views.<view_name>.relations.<relation_name>
 [schemas.public.views.my_view.relations.my_view_to_my_table]
+
 # The schema containing the referenced table or view.
 # Defaults to "public" if omitted. Must exist.
 referenced_schema = "public"

cli/postgres/README.md

@@ -30,6 +30,10 @@ impl RelationKind {
             RelationKind::MaterializedView => "MATERIALIZED_VIEW",
         }
     }
+
+    pub fn is_view(self) -> bool {
+        !matches!(self, RelationKind::Relation)
+    }
 }
 
 impl<T> Copy for Table<T> where T: Copy {}

crates/database-definition/src/table.rs

@@ -1,10 +1,27 @@
+use grafbase_database_definition::TableWalker;
 use serde::Deserialize;
 use std::collections::HashMap;
 
+/// Returns the default value for enable_queries configuration.
+fn default_enable_queries() -> bool {
+    true
+}
+
+/// Returns the default value for enable_mutations configuration.
+fn default_enable_mutations() -> bool {
+    true
+}
+
 /// Represents the overall configuration for the application.
 #[derive(Deserialize, Debug)]
 #[serde(deny_unknown_fields)]
 pub struct Config {
+    /// Determines whether mutations (write operations) are enabled for this configuration.
+    #[serde(default = "default_enable_mutations")]
+    pub enable_mutations: bool,
+    /// Determines whether queries (read operations) are enabled for this configuration.
+    #[serde(default = "default_enable_queries")]
+    pub enable_queries: bool,
     /// The name of the database this virtual subgraph uses (the name from grafbase.toml).
     #[serde(default = "default_database_name")]
     pub database_name: String,
@@ -19,6 +36,46 @@ pub struct Config {
     pub schemas: HashMap<String, SchemaConfig>,
 }
 
+impl Config {
+    /// Determines whether mutations (write operations) are allowed for the specified table.
+    pub fn mutations_allowed(&self, table: TableWalker<'_>) -> bool {
+        if !table.mutations_allowed() {
+            return false;
+        }
+
+        let Some(schema_config) = self.schemas.get(table.schema()) else {
+            return self.enable_mutations;
+        };
+
+        let Some(table_config) = schema_config.tables.get(table.database_name()) else {
+            return schema_config.enable_mutations;
+        };
+
+        table_config.enable_mutations
+    }
+
+    /// Determines whether queries (read operations) are allowed for the specified table.
+    pub fn queries_allowed(&self, table: TableWalker<'_>) -> bool {
+        let Some(schema_config) = self.schemas.get(table.schema()) else {
+            return self.enable_queries;
+        };
+
+        if table.relation_kind().is_view() {
+            let Some(view_config) = schema_config.views.get(table.database_name()) else {
+                return schema_config.enable_queries;
+            };
+
+            view_config.enable_queries
+        } else {
+            let Some(table_config) = schema_config.tables.get(table.database_name()) else {
+                return schema_config.enable_queries;
+            };
+
+            table_config.enable_queries
+        }
+    }
+}
+
 /// Returns the default database name.
 fn default_database_name() -> String {
     "default".to_string()
@@ -33,6 +90,12 @@ fn default_default_schema() -> String {
 #[derive(Deserialize, Debug)]
 #[serde(deny_unknown_fields)]
 pub struct SchemaConfig {
+    /// Determines whether mutations (write operations) are enabled for this schema.
+    #[serde(default = "default_enable_mutations")]
+    pub enable_mutations: bool,
+    /// Determines whether queries (read operations) are enabled for this schema.
+    #[serde(default = "default_enable_queries")]
+    pub enable_queries: bool,
     /// Configuration details for each view within the database, keyed by view name.
     #[serde(default)]
     pub views: HashMap<String, ViewConfig>,
@@ -41,10 +104,15 @@ pub struct SchemaConfig {
     pub tables: HashMap<String, TableConfig>,
 }
 
-/// Represents the configuration settings for a specific database relation (e.g., a view).
 #[derive(Deserialize, Debug)]
 #[serde(deny_unknown_fields)]
 pub struct TableConfig {
+    /// Determines whether mutations (write operations) are enabled for this table.
+    #[serde(default = "default_enable_mutations")]
+    pub enable_mutations: bool,
+    /// Determines whether queries (read operations) are enabled for this table.
+    #[serde(default = "default_enable_queries")]
+    pub enable_queries: bool,
     /// Configuration details for relationships originating from this view, keyed by relationship name.
     #[serde(default)]
     pub relations: HashMap<String, RelationConfig>,
@@ -54,6 +122,12 @@ pub struct TableConfig {
 #[derive(Deserialize, Debug)]
 #[serde(deny_unknown_fields)]
 pub struct ViewConfig {
+    /// Determines whether mutations (write operations) are enabled for this table.
+    #[serde(default = "default_enable_mutations")]
+    pub enable_mutations: bool,
+    /// Determines whether queries (read operations) are enabled for this table.
+    #[serde(default = "default_enable_queries")]
+    pub enable_queries: bool,
     /// Optional list of unique key constraints, where each constraint is a list of column names.
     pub unique_keys: Option<Vec<Vec<String>>>,
     /// Configuration details for each column within the relation, keyed by column name.

crates/postgres-introspection/src/config.rs

@@ -32,12 +32,7 @@ pub async fn introspect(conn: &mut sqlx::PgConnection, config: Config) -> anyhow
 
     database_definition.finalize();
 
-    Ok(render::to_sdl(
-        database_definition,
-        &config.extension_url,
-        &config.default_schema,
-        &config.database_name,
-    ))
+    Ok(render::to_sdl(database_definition, &config))
 }
 
 /// A list of schemas to filter out automatically on every introspection.

crates/postgres-introspection/src/lib.rs

@@ -11,16 +11,29 @@ mod tables;
 use ast::schema::Schema;
 use grafbase_database_definition::DatabaseDefinition;
 
+use crate::config::Config;
+
 const DEFAULT_DATABASE_NAME: &str = "default";
 
-pub fn to_sdl(
-    database_definition: DatabaseDefinition,
-    extension_url: &str,
-    default_schema: &str,
-    database_name: &str,
-) -> String {
+/// Defines if at least one table has queries or mutations enabled.
+#[derive(Debug, Clone, Copy)]
+struct EnabledOperations {
+    has_queries: bool,
+    has_mutations: bool,
+}
+
+pub fn to_sdl(database_definition: DatabaseDefinition, config: &Config) -> String {
+    let database_name = config.database_name.as_str();
+    let extension_url = config.extension_url.as_str();
+    let default_schema = config.default_schema.as_str();
+
     let mut rendered = Schema::new();
 
+    let mut operations = EnabledOperations {
+        has_queries: false,
+        has_mutations: false,
+    };
+
     let prefix = if database_name == DEFAULT_DATABASE_NAME {
         None
     } else {
@@ -29,12 +42,18 @@ pub fn to_sdl(
 
     scalars::render(&mut rendered);
     schema_directives::render(&database_definition, extension_url, &mut rendered);
-    enums::render(&database_definition, default_schema, &mut rendered);
-    input_types::render(&database_definition, prefix, &mut rendered);
-    output_types::render(&database_definition, &mut rendered);
-    tables::render(&database_definition, default_schema, &mut rendered);
-    query::render(&database_definition, prefix, &mut rendered);
-    mutation::render(&database_definition, prefix, &mut rendered);
+    input_types::render(&database_definition, config, &mut operations, prefix, &mut rendered);
+    enums::render(&database_definition, default_schema, &operations, &mut rendered);
+    output_types::render(&database_definition, config, operations, &mut rendered);
+    tables::render(&database_definition, default_schema, operations, &mut rendered);
+
+    if operations.has_queries {
+        query::render(&database_definition, config, prefix, &mut rendered);
+    }
+
+    if operations.has_mutations {
+        mutation::render(&database_definition, config, prefix, &mut rendered);
+    }
 
     rendered.to_string()
 }

crates/postgres-introspection/src/render.rs

@@ -1,28 +1,38 @@
 use grafbase_database_definition::DatabaseDefinition;
 
-use super::ast::{
-    directive::{Argument, Directive},
-    r#enum::{Enum, EnumVariant},
-    schema::Schema,
+use super::{
+    EnabledOperations,
+    ast::{
+        directive::{Argument, Directive},
+        r#enum::{Enum, EnumVariant},
+        schema::Schema,
+    },
 };
 
-pub fn render<'a>(database_definition: &'a DatabaseDefinition, default_schema: &'a str, rendered: &mut Schema<'a>) {
-    rendered.push_enum({
-        let mut r#enum = Enum::new("OrderDirection");
-        r#enum.set_description("Specifies the direction for ordering results.");
+pub fn render<'a>(
+    database_definition: &'a DatabaseDefinition,
+    default_schema: &'a str,
+    operations: &EnabledOperations,
+    rendered: &mut Schema<'a>,
+) {
+    if operations.has_queries {
+        rendered.push_enum({
+            let mut r#enum = Enum::new("OrderDirection");
+            r#enum.set_description("Specifies the direction for ordering results.");
 
-        for (variant, description) in [
-            ("ASC", "Specifies an ascending order for a given orderBy argument."),
-            ("DESC", "Specifies a descending order for a given orderBy argument."),
-        ] {
-            let mut variant = EnumVariant::new(variant);
-            variant.set_description(description);
+            for (variant, description) in [
+                ("ASC", "Specifies an ascending order for a given orderBy argument."),
+                ("DESC", "Specifies a descending order for a given orderBy argument."),
+            ] {
+                let mut variant = EnumVariant::new(variant);
+                variant.set_description(description);
 
-            r#enum.push_variant(variant);
-        }
+                r#enum.push_variant(variant);
+            }
 
-        r#enum
-    });
+            r#enum
+        });
+    }
 
     for r#enum in database_definition.enums() {
         let mut render = Enum::new(r#enum.client_name());