exAspArk / graphql-guard

Simple authorization gem for GraphQL :lock:
MIT License
471 stars 36 forks source link

guard lambdas are receiving the schema type object, rather than the found instance #40

Closed xxx closed 4 years ago

xxx commented 4 years ago

Hi,

I just found this gem, and am looking to integrate it. I've run into an issue where my guard lambdas are receiving the graphql type object as the object argument, rather than the found instance that I expect (and the examples in the README also imply that this is what I should be receiving.) This behavior is showing up in all cases.

I'm currently using version 2.0.0, with the latest versions of all the related GraphQL gems.

My setup for testing this is currently

PROJECT_MEMBER_GUARD = lambda { |object, _args, context|
  user = context.fetch(:current_user, nil)
  ProjectMemberPolicy.new(user, object).show?
}

as the guard, which is attached via

field :project,
      Types::ProjectType,
      null: false,
      description: 'Get a single project',
      guard: PROJECT_MEMBER_GUARD do
  argument :id, ID, required: true, description: 'The project ID'
end

def project(id:)
  # Project.find id also fails
  RecordLoader.for(Project).load(id)
end

Am I doing something wrong? Without guard / auth checks, the queries run as expected. I'm completely baffled right now.

The specific error i'm receiving is "undefined method `to_global_id' for #<Types::QueryType:0x000056063dace2e0>", but the issue is that the object shouldn't be a Types::QueryType object, as far as my understanding goes.

xxx commented 4 years ago

this may be graphql gem itself causing this, as even overriding authorized? is getting a nil for the object. Will close this to check into that thread instead.