Honor GraphQL Auth Rules

[verneleem]

needs to respect GraphQL authentication rules.

[verneleem]

You wanna provide the whole DB? That sounds insecure. Give end-user access to the whole DB. He just needs the basics. A DB commonly used in smartphones is enough. But it requires a business logic to be built.

[verneleem]

TBD: will users be authenticated based upon local machines local credentials with a generated JWT, or will users need to authenticate against an online service that responds with a JWT. This discussion will determine if users can authenticate when offline, or if can only use last online authenticated credentials for as long as they last. Maybe allow users to authenticate when online with a long lived JWT. What happens when user logs out, or a different user logs in from a different client on the same thin client.

[maaft]

I think that we should include auth rules.

Of course we can not fully secure user data (everyone with access to the db can read it) but dgraph auth rules also help a lot when making simple queries as you don't need to care to filter data that you don't own.

[amaster507]

Just FYI, auth rules are implemented in the GraphQL endpoint on every request by rewriting the GraphQL query/mutation and adding var blocks that check for ids that the align with a rule. We can do somewhat the same.

At the GraphQL API, it still reads all of the data and then filters it blindly to the application layer to only what matches the rules.

This heavily depends on how we implement sync functionality. Do we sync all data, only data that has already been requested, data for certain users, how do we handle syncing data for multiple users, or data for the same user that varies based upon which access they are currently using.

I can go on more about this later, but I have a full schedule today, I can jump back in this discussion tomorrow evening. CST