Add support for Entitlement-based Authorization

[hasura-ericnelson]

Component

c/v3-engine

Is your proposal related to a problem?

No

Describe the solution you'd like

Entitlement-based authorization would allow for more granular access control based on specific attributes of the data being accessed. Currently, if Hasura receives a request for an attribute the requestor does have access to, the query will not execute and an error is returned. Entitlements would allow for this query to execute, but only return the data that the requestor has access to. Attributes the requestor does not have access to will be blank (empty string or null, etc.) For example, if I have a User object with this shape:

Employee: {
	name: "john smith",
	email: "jsmith@example.com",
	salary: 100000,
	location: "Chicago, IL",
	lastLogin: 2024-06-24T18:01:46.072Z
}

With this Entitlements configuration:

default entitlement has access to name, email properties

salaryentitlement has access to everything default has access to, plus salary

location entitlement has access to everything default has access to, plus location

As the requestor, if I have the default entitlement and make a request for the full Employee object, I will see the following:

data: {
	name: "john smith",
	email: "jsmith@example.com",
	salary: null,
	location: "",
	lastLogin: null
}

If I have the salary and location entitlements, I will see:

Employee: {
	name: "john smith",
	email: "jsmith@example.com",
	salary: 100000,
	location: "Chicago, IL",
	lastLogin: null
}

if I have an admin entitlement, I have access to all attributes

Describe alternatives you've considered

None. Current Authorization rules do no provide this.