Support permission for queries and mutations about graffiti-mongoose

[tothandras]

@nodkz Custom resolve logic is currently not possible with the API, but we will add it soon. Most likely next week. I will paste here a snippet how to do it, when it's available.

[nodkz]

Great! Thank you. I will wait with impatience.

Also it will be nice if you add ability to provide middleware for schema here
https://github.com/RisingStack/graffiti/blob/master/src/koa/index.js#L12

I am start migrating from ruby to nodejs about one month ago, so I am not so free filling to do PR now.

[stanonyime]

+1

[tothandras]

We have proof of concept for authorization, field manipulation and other custom actions:

• specify before and after resolve hooks in your schema

const UserSchema = new mongoose.Schema({
  name: {
    type: String
  },
  age: {
    type: Number,
    index: true
  },
  friends: {
    type: [{
      type: mongoose.Schema.Types.ObjectId,
      ref: 'User'
    }],
    hooks: {
      before: (source, args, {rootValue} = {}) => {
        if (rootValue && !rootValue.auth) {
          throw new Error('Not authorized');
        }
      },
      after: (result) => {
        result.edges = result.edges.map((edge) => {
          edge.node.age *= 2;
          return edge;
        });
        return result;
      }
    }
  }
});

const User = mongoose.model('User', UserSchema);

You can use the context parameter to pass in fields like auth when you call graphql.

const auth = verifyUser(request);
const context = {auth};
graphql(schema, query, context, variables)

@nodkz @stanonyime Tell us what you think!

[nodkz]

Simple. And many peoples will be used this way.

BUT I want recommend you implement another way - like Redux Middleware.

friends: {
    type: [{
      type: mongoose.Schema.Types.ObjectId,
      ref: 'User'
    }],
    write_hooks: [authRequired, isUserPublicProfile],
    read_hooks: [capitalize]
  }

where authRequired function can look like:

export default function authRequired({ rootValue }) {
  return next => source => args =>
    if (rootValue && !rootValue.auth) {
          throw new Error('Not authorized');
          // or if we want return empty document without error
          return next(null)
    }
    return next(source);
}

PS. I have no practical experience how to implement it, but theoretically it will be more reusable, self-documented. And not be similar to jQuery-way ;)

@gaearon please give your advice. Or ask somebody else who have great experience in middleware realization. I know only you. Thanks!

[tothandras]

@nodkz I've implemented something similar, please check it out!

[nodkz]

Awesome! Great thanks.

I think it is no problem if get just single function. Instead of exception, you can made middleware = [middleware]. How I understood it will be called only once with schema initialization.

if (!isArray(middleware)) {
  throw new TypeError('Middleware stack must be an array!');
}

PS. I think I missed something: went to learn await and async, and how it intersects with promises.

[tothandras]

@nodkz Sure! I will allow a single function too. It is called on each resolve.

[tothandras]

@nodkz Resolve hooks on type fields has been added, soon we will have something similar for root fields too: https://github.com/RisingStack/graffiti-mongoose#resolve-hooks

[nodkz]

Awesome! Thanks.

[tothandras]

@nodkz, @hardchor
Support for query and mutation hooks #57

[tothandras]

@nodkz With hooks you can implement all these features now. ;)