Authorization for Action's output types

[quantumlicht]

Hello,

I am looking for feedback for the best way to achieve this.

Supposed I have an action of query type that performs complex filtering on a table called price

My goal is that clients of the API can insert prices according to simple rules (captured by hasura permission engine)
However select prices needs to be restricted in accordance witth my business logic

My output type looks like:

type PriceOutput {
  price_id : Int!
  organisation_id : Int!
}

And there is a relationship to link to the price table.

Now maybe you see the problem. How can I restrict cients from selecting only the subset of prices I want them to, if I also need them to select the prices they are allowed?

My idea is that I would need to explode the price model into the output type, and remove the relationship on the price table.
That's seems doable, but also not ideal, since I would need to make sure the price table is always aligned with this custom output type.

Any suggestions?