search

Graphcool / graphcool-framework

Apache License 2.0
1.78k stars 130 forks source link

Define permissions for resolver functions #120

Open marktani opened 6 years ago

marktani commented 6 years ago

Issue by kbrandwijk Sunday Jul 23, 2017 at 01:16 GMT Originally opened as https://github.com/graphcool/prisma/issues/324

Currently, there's no way to define permissions for resolver function queries and mutations.

marktani commented 6 years ago

Comment by marktani Monday Jul 24, 2017 at 09:41 GMT

How should that look like in your opinion? The EVERYONE and AUTHENTICATED permissions would be straight-forward, but how about permission queries?

I'd like to brainstorm about possible PQs and what variables would be needed as a result 🙂 $user_id makes a lot of sense here, what do you think about having access to the scalar input values a well?

marktani commented 6 years ago

Comment by kbrandwijk Monday Jul 24, 2017 at 09:48 GMT

I already took the first part into consideration when I came up with this. So this fits in there nicely.

Regarding fields, yes I think that it would be the most consistent behavior if input values are available to the PQ.

Also, regarding the PQ themselves. If I have a SE that acts on an existing type (highlightPost(postId: ID!)), it makes perfect sense to use SomePostExist in a PQ, so I think they can for the most part behave like the other PQ's. Especially with the calling context available (can't find the FR), having $user_id in there starts making sense too!

marktani commented 6 years ago

Comment by danielrasmuson Wednesday Dec 27, 2017 at 04:55 GMT

What about using the same permission syntax as a check in order to call the function.

I.E.

- operation: MyFunctionName
  authenticated: true
  query: ./should-call-my-func.graphql

And if that query passes the function will be invoked.

marktani commented 6 years ago

Comment by mikhailvs Wednesday Jan 17, 2018 at 03:24 GMT

This feature would be helpful to have.

marktani commented 6 years ago

Comment by donedgardo Wednesday Jan 17, 2018 at 20:49 GMT

+1 Currently permissions work for crud operations or has this change with v1.0?

marktani commented 6 years ago

Comment by LFP6 Wednesday Jan 17, 2018 at 21:56 GMT

FWIW this is how permissions are supposed to be handled in Prisma at this point: https://www.prismagraphql.com/docs/tutorials/graphql-server-development/permissions-thohp1zaih Is there still a reason to have a separate mechanism for defining permissions?

ahsanwtc commented 6 years ago

yeah would be nice to have restricted access to certain resolvers