[DEV-2711] Disable GraphQL Introspection on Hasura

[0x1]

PR Type

• Regular Task
• Bug Fix
• QA Tests

Description

DEV-2711 — Disable GraphQL Introspection on Hasura

• Hasura's /v1/graphql endpoint accepted unauthenticated __schema introspection queries, exposing schema metadata to anyone
• Fixed by adding all non-admin roles to disabled_for_roles in hasura/metadata/graphql_schema_introspection.yaml — this is applied automatically at Hasura startup in all environments, including production, with no infra changes needed
• Admin secret requests bypass this by design (Hasura hardcodes it), so the console and codegen are unaffected

NOTE: i would have preferred to have explicitly enabling roles instead of explicitly disabling as we do here. from a security standpoint an allowlist is strictly better — new roles are blocked by default rather than open until someone
remembers to add them, but Hasura's metadata config only exposes disabled_for_roles (a denylist). There's no enabled_for_roles equivalent.

Checklist

• I have self-reviewed this PR.
• I have left comments in the code for clarity.
• I have added necessary unit tests.
• I have updated the documentation as needed.

[0x1]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 926a58d4fd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[0x1]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[andy-t-wang]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}