search

exAspArk / graphql-guard

Simple authorization gem for GraphQL :lock:
MIT License
471 stars 36 forks source link

Pundit field whitelisting #27

Closed yourivdlans closed 5 years ago

yourivdlans commented 5 years ago

First of all, thanks for this great gem! I love the simplicity.

By default this gem follows a blacklisting strategy where you disable access to queries, fields, etc. I'd like it the other way around and whitelist everything that is allowed to be used.

So far I have an implementation that works (based on other discussions on this gem).

The problem with my implementation is that for each field I will need to have a proc which tests the access.

See: https://gist.github.com/yourivdlans/7d1093e5500820804a7ca8d263c98ecf

This might grow to something unmanageable which I'd like to avoid.

What could work is if the field name would be passed into the proc, but I'm not sure if this is the right approach.

Would love to hear your opinion and thoughts :)

Thanks!

ghost commented 5 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.