PR Type

• Regular Task
• Bug Fix
• QA Tests

Description

DEV-2711 — Disable GraphQL Introspection on Hasura

• Hasura's /v1/graphql endpoint accepted unauthenticated __schema introspection queries, exposing schema metadata to anyone
• Fixed by adding all non-admin roles to disabled_for_roles in hasura/metadata/graphql_schema_introspection.yaml — this is applied automatically at Hasura startup in all environments, including production, with no infra changes needed
• Admin secret requests bypass this by design (Hasura hardcodes it), so the console and codegen are unaffected

NOTE: i would have preferred to have explicitly enabling roles instead of explicitly disabling as we do here. from a security standpoint an allowlist is strictly better — new roles are blocked by default rather than open until someone
remembers to add them, but Hasura's metadata config only exposes disabled_for_roles (a denylist). There's no enabled_for_roles equivalent.

Checklist

• I have self-reviewed this PR.
• I have left comments in the code for clarity.
• I have added necessary unit tests.
• I have updated the documentation as needed.