graphcool.yml

# Specify the schema for Corum
types: ./types.graphql

functions:
  # Resolvers

  # 'signupUser' Mutation Resolver
  signup:
    type: resolver
    schema: src/user/signup.graphql
    handler:
      code:
        src: src/user/signup.js

  # 'authenticateUser' Mutation Resolver
  authenticate:
    type: resolver
    schema: src/user/authenticate.graphql
    handler:
      code:
        src: src/user/authenticate.js

  # Hook functions

  # Initialises 'voteCount' to 0 on a new post
  initVoteCount:
    type: operationBefore
    operation: Post.create
    handler:
      code: 
        src: src/post/initVoteCount.js
  
  # Ensures that a user can only create one favorite per subforum
  userAndSubforumIsUniqueOnFavorite:
    type: operationBefore
    operation: Favorite.create
    handler:
      code:
        src: src/favorite/userAndSubforumIsUnique.js

  # Ensures that a user cannot vote on a post more that once
  userAndPostIsUniqueOnVote:
    type: operationBefore
    operation: Vote.create
    handler:
      code:
        src: src/vote/userAndPostIsUnique.js

  # Functions to handle updating the 'voteCount' value on the Post
  # type when a vote operation occurs, as well as deleting the
  # associated post if the vote count drops below a certain value.

  updatePostVoteCountOnVoteCreation:
    type: operationAfter
    operation: Vote.create
    handler:
      code: 
        src: src/post/updateVoteCountOnVoteCreation.js

  updatePostVoteCountOnVoteUpdate:
    type: operationAfter
    operation: Vote.update
    handler:
      code: 
        src: src/post/updateVoteCountOnVoteUpdate.js

  updatePostVoteCountOnVoteDeletion:
   type: operationBefore
   operation: Vote.delete
   handler:
     code: 
       src: src/post/updateVoteCountOnVoteDeletion.js

rootTokens:
  - signup
  - authenticate
  - updatePostVoteCountOnVoteCreation
  - updatePostVoteCountOnVoteUpdate
  - updatePostVoteCountOnVoteDeletion

# Where 'authenticated: true' is present in an operation,
# the client must pass along their JWT auth token in the
# request headers. (In the form -> Authorization: 'Bearer ${TOKEN}')

# Eventually write permission queries for the following:
# - User
#   - Only the user can update their favorites
# - Post
#   - A user cannot impersonate another user (author has to be the user logged in)
# - Comment 
#   - A user cannot impersonate another user (author has to be the user logged in)
# - Vote
#   - A user cannot impersonate another user (author has to be the user logged in)
#   - This applies to create, update and delete

permissions:
    # User Permissions

    # Allows access to User from Post
    # Only the username field is made queryable. This means
    # that malicious users cannot query for someones elses
    # information such as their password, id, or email.
  - operation: User.read  
    fields: [username]

  # Subforum Permissions
  - operation: Subforum.create
    authenticated: true
  - operation: Subforum.read

  # Favorite Permissions
  - operation: Favorite.create
    authenticated: true
    # permission query here
  - operation: Favorite.read
  - operation: Favorite.delete
    authenticated: true
    # permission query here

  # Post Permissions
  - operation: Post.create
    authenticated: true
    # permission query here
  - operation: Post.read

  # Comment Permissions
  - operation: Comment.create
    authenticated: true
    # permission query here
  - operation: Comment.read

  # Vote Permissions
  - operation: Vote.create
    authenticated: true
    # permission query here
  - operation: Vote.read
  - operation: Vote.update
    authenticated: true
    # permission query here
  - operation: Vote.delete
    authenticated: true
    # permission query here

  # Relation Permissions
  - operation: SubforumToPost.connect
    authenticated: true
    # permission query here
  - operation: PostToComment.connect
    authenticated: true
    # permission query here
  - operation: UserToPost.connect
    authenticated: true
    # permission query here
  - operation: UserToVote.connect
    authenticated: true
    # permission query here
  - operation: PostToVote.connect
    authenticated: true
    # permission query here
  - operation: UserToFavorite.connect
    authenticated: true
    # permission query here
  - operation: SubforumToFavorite.connect
    authenticated: true
    # permission query here