neiljohari
commented
4 years ago It also seems like this case of nil user is not tested: https://github.com/palkan/action_policy-graphql/blob/796bc6fcc3dd859df3e31aa2dbb04ec491ba587e/spec/support/schema.rb#L99
The current_user is always set to something by default in that spec (:user).
I am able to somewhat solve my issue via the Null Object pattern (creating a null user). It's not ideal since I'd rather be able to just query for permissions with a missing context defaulting to false, but here's my current solution:
class GraphqlController < ApplicationController
def execute
...
context = {
current_user: Current.user || ::NullUser.new
}
...
end
endmodule Types
class QueryType < Types::BaseObject
...
field :viewer, UserType, null: true
def viewer
return context[:current_user].is_a?(::NullUser) ? nil : context[:current_user]
end
...
endThis way from the front-end view, viewer genuinely appears as null, but in Ruby (and thus all places Action Policy checks), the NullUser is used to bypass the missing context errors.
The biggest downside I see is some changes in convention of how the client asks what it's allowed to do. Whereas before I was able to ask if the viewer was able to do something, and differentiate it clearly from whether another user is allowed to:
query {
viewer {
canCreateCourses {
value
}
}
}I now must conventionally define viewer permissions at the root level:
query {
canCreateCourses {
value
}
}Not the worst trade off in the world. Thoughts? Is this just me working around an action policy bug, or is this how we're expected to handle missing context?
palkan
Say I had a
CourseTypewith a way to query it fromQueryTypewith no authorization, through a field calledcourses. Then the following query works as expected, returning a list of Course ids:The problem is, when
context[:current_user]is null, attempting to access any of the exposed rules raises an exceptionMissing policy authorization context: user.For instance, lets say that the
CourseTypehas a way to query for a list ofLessonTypewith no authorization, through a field calledlessons. Additionally, consider that we expose the ability to create lessons on CourseType with the following:expose_authorization_rules :create?, with: LessonPolicy, field_name: :can_create_lesson.Now, if we ask the value of
canCreateLesson, an exception will be raised:Here is the graphql response with error backtrace:
I believe this is a bug? The expected behavior (I think) is to simply return false values with reasons (maybe something like
user?as the reason for I18n integration).Looking through the action_policy-graphql code, it seems like having user in the context is a requirement? However, when I try to set the user context to
Current.user || {}to avoidnilvalues, then I get a new error altogether: