Field Level Permissions

[bk-equityzen]

For complex projects it can get unmanageable to rely on having a separate Registry and recreate every DjangoObjectType node for every granular level of permissioning needed. I'm proposing a way to define field level permissions.

I have some hacky proof of concept code that works by injecting permission checking at the resolver level. Let me know if there's interest in making this solution more comprehensive and contributing to make this part of a future release @syrusakbary

Inspiration from:
https://www.prisma.io/blog/graphql-directive-permissions-authorization-made-easy-54c076b5368e/
https://blog.apollographql.com/authorization-in-graphql-452b1c402a9

In my schema.py

def public(obj, info):
    return True

class DealPermissions(object):

    @classmethod
    def check_deal_has_user(cls, deal, info):
        user = info.context.user
        return user in deal.users.all()

class DealNode(DjangoObjectType):
    name = graphene.String()

    class Meta:
        model = Deal
        interfaces = (relay.Node,)

    auth = {
        # In Deal
        'id': [public],
        'name': [DealPermissions.check_deal_has_user],
    }

In typemap.py

    def construct_fields_for_type(self, map, type, is_input_type=False):
                ...
                resolver = self.get_resolver_for_type(type, name, field.default_value)
                def auth_resolver(func):
                    def auth_func(*args, **kwargs):
                        auth_dict = getattr(type, 'auth', None)
                        if auth_dict:
                            obj = args[0]
                            info = args[1]
                            field_name = to_snake_case(info.field_name)
                            authed = False
                            available_auths = auth_dict.get(field_name, [])
                            for auth_available_func in available_auths:
                                if auth_available_func(obj, info):
                                    authed = True

                            if not authed:
                                raise GraphQLError('You are not authorized! Obj: %s, Field: %s, User: %s' % (obj, field_name, info.context.user))

                        return func(*args, **kwargs)
                    return auth_func

                if resolver:
                    resolver = auth_resolver(resolver)

                ...
        return fields

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.