Add skip query selectors that require auth in anon role

psql/query.go

@@ -82,17 +82,21 @@ func (co *Compiler) compileQuery(qc *qcode.QCode, w io.Writer) (uint32, error) {
 	multiRoot := (len(qc.Roots) > 1)
 
 	st := NewIntStack()
+	si := 0
 
 	if multiRoot {
 		io.WriteString(c.w, `SELECT row_to_json("json_root") FROM (SELECT `)
 
-		for i, id := range qc.Roots {
+		for _, id := range qc.Roots {
 			root := qc.Selects[id]
+			if root.SkipRender {
+				continue
+			}
 
 			st.Push(root.ID + closeBlock)
 			st.Push(root.ID)
 
-			if i != 0 {
+			if si != 0 {
 				io.WriteString(c.w, `, `)
 			}
 
@@ -103,24 +107,34 @@ func (co *Compiler) compileQuery(qc *qcode.QCode, w io.Writer) (uint32, error) {
 			io.WriteString(c.w, `"`)
 
 			alias(c.w, root.FieldName)
+			si++
 		}
 
-		io.WriteString(c.w, ` FROM `)
+		if si != 0 {
+			io.WriteString(c.w, ` FROM `)
+
+		}
 
 	} else {
 		root := qc.Selects[0]
+		if !root.SkipRender {
+			io.WriteString(c.w, `SELECT json_object_agg(`)
+			io.WriteString(c.w, `'`)
+			io.WriteString(c.w, root.FieldName)
+			io.WriteString(c.w, `', `)
+			io.WriteString(c.w, `json_`)
+			int2string(c.w, root.ID)
 
-		io.WriteString(c.w, `SELECT json_object_agg(`)
-		io.WriteString(c.w, `'`)
-		io.WriteString(c.w, root.FieldName)
-		io.WriteString(c.w, `', `)
-		io.WriteString(c.w, `json_`)
-		int2string(c.w, root.ID)
+			st.Push(root.ID + closeBlock)
+			st.Push(root.ID)
 
-		st.Push(root.ID + closeBlock)
-		st.Push(root.ID)
+			io.WriteString(c.w, `) FROM `)
+			si++
+		}
+	}
 
-		io.WriteString(c.w, `) FROM `)
+	if si == 0 {
+		return 0, errors.New("all tables skipped. cannot render query")
 	}
 
 	var ignored uint32
@@ -161,6 +175,9 @@ func (co *Compiler) compileQuery(qc *qcode.QCode, w io.Writer) (uint32, error) {
 					continue
 				}
 				child := &c.s[cid]
+				if child.SkipRender {
+					continue
+				}
 
 				st.Push(child.ID + closeBlock)
 				st.Push(child.ID)
@@ -475,18 +492,22 @@ func (c *compilerContext) renderRemoteRelColumns(sel *qcode.Select, ti *DBTableI
 }
 
 func (c *compilerContext) renderJoinedColumns(sel *qcode.Select, ti *DBTableInfo, skipped uint32) error {
-	colsRendered := len(sel.Cols) != 0
+
+	// columns previously rendered
+	i := len(sel.Cols)
 
 	for _, id := range sel.Children {
-		skipThis := hasBit(skipped, uint32(id))
-
-		if colsRendered && !skipThis {
-			io.WriteString(c.w, ", ")
-		}
-		if skipThis {
+		if hasBit(skipped, uint32(id)) {
 			continue
 		}
 		childSel := &c.s[id]
+		if childSel.SkipRender {
+			continue
+		}
+
+		if i != 0 {
+			io.WriteString(c.w, ", ")
+		}
 
 		//fmt.Fprintf(w, `"%s_%d_join"."%s" AS "%s"`,
 		//s.Name, s.ID, s.Name, s.FieldName)
@@ -500,6 +521,7 @@ func (c *compilerContext) renderJoinedColumns(sel *qcode.Select, ti *DBTableInfo
 		io.WriteString(c.w, `" AS "`)
 		io.WriteString(c.w, childSel.FieldName)
 		io.WriteString(c.w, `"`)
+		i++
 	}
 
 	return nil
@@ -632,10 +654,6 @@ func (c *compilerContext) renderBaseSelect(sel *qcode.Select, ti *DBTableInfo,
 		}
 	}
 
-	// if i != 0 && len(sel.OrderBy) != 0 {
-	// 	io.WriteString(c.w, ", ")
-	// }
-
 	for _, ob := range sel.OrderBy {
 		if _, ok := colmap[ob.Col]; ok {
 			continue

psql/query_test.go

@@ -463,6 +463,30 @@ func multiRoot(t *testing.T) {
 	}
 }
 
+func skipUserIDForAnonRole(t *testing.T) {
+	gql := `query {
+		products {
+			id
+			name
+			user(where: { id: { eq: $user_id } }) {
+				id
+				email
+			}
+		}
+	}`
+
+	sql := `SELECT json_object_agg('products', json_0) FROM (SELECT coalesce(json_agg("json_0"), '[]') AS "json_0" FROM (SELECT row_to_json((SELECT "json_row_0" FROM (SELECT "products_0"."id" AS "id", "products_0"."name" AS "name") AS "json_row_0")) AS "json_0" FROM (SELECT "products"."id", "products"."name", "products"."user_id" FROM "products" LIMIT ('20') :: integer) AS "products_0" LIMIT ('20') :: integer) AS "json_agg_0") AS "sel_0"`
+
+	resSQL, err := compileGQLToPSQL(gql, nil, "anon")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if string(resSQL) != sql {
+		t.Fatal(errNotExpected)
+	}
+}
+
 func blockedQuery(t *testing.T) {
 	gql := `query {
 		user(id: 5, where: { id: { gt: 3 } }) {
@@ -524,6 +548,7 @@ func TestCompileQuery(t *testing.T) {
 	t.Run("queryWithVariables", queryWithVariables)
 	t.Run("withWhereOnRelations", withWhereOnRelations)
 	t.Run("multiRoot", multiRoot)
+	t.Run("skipUserIDForAnonRole", skipUserIDForAnonRole)
 	t.Run("blockedQuery", blockedQuery)
 	t.Run("blockedFunctions", blockedFunctions)
 }