search

neo4j-graphql / neo4j-graphql-java

Neo4j Labs Project: Pure JVM translation for GraphQL queries and mutations to Neo4j's Cypher
Apache License 2.0
105 stars 49 forks source link

Authorization rules? #298

Closed rickardoberg closed 1 year ago

rickardoberg commented 1 year ago

We need to perform authorization checks for what data a user is able to see/process/return. What is the recommended way to add such rules with this library? Is there a built-in mechanism for it, or some kind of transformer option that we could use?

Preferably we would be able to package those rules in a Java predicate which would be invoked as the data is processed by the GraphQL evaluator.

Andy2003 commented 1 year ago

This is part of the ongoing refactoring / migration to be API-aligned with the JS-Version.

rickardoberg commented 1 year ago

Some update on this. In the end we completely replaced QueryHandler with our own Cypher translation, and in doing so we could introduce our authorization rules both for objects and fields.