search

graphql-devise / graphql_devise

GraphQL interface on top devise_token_auth
MIT License
200 stars 39 forks source link

Scoping auth tokens to more than one model #249

Closed benkovy closed 1 year ago

benkovy commented 1 year ago

A theoretical User has many Organizations. When they sign in I am wondering if it is possible to have that token only be valid for actions against that Org.

The idea would be that the organization is resolved via some header that is passed up in the request. Upon login that header maps to an Organization - then some logic determines whether the user is actually part of that organization - and if they are the login should be successful.

Is there anyway to tie one token to two models?

mcelicalderon commented 1 year ago

Hey, @benkovy! I'm not sure I completely understand what you want to accomplish.

Is there anyway to tie one token to two models?

I guess you could change the logic in the login mutation so if you login using one model you could set the same token for another model with a field in common?

Also, I think what you are saying sounds a bit like oauth? So upon login you can choose what the user login in has access to? I know DTA has oauth support, I'll take a look and see how that might look with tus gem. But at least for now, I think the gem won't support what you need, but you might be able to implement it yourself