Comments (2)
Hey @everdev 👋,
I see what you are trying to do. Customer, in case of the example, doesn't ensure that the basket belongs to the particular user. I would say that these two problems are of a bit different nature. Let me explain the idea;
When using Prisma only as a database
layer, we can implicitly define which basket we want to add items to. In case of the example, we obtain user's basketId
and connect the item to it. isCustomer
, in this case only ensures the user is logged in and properly set up.
Your case is, in my opinion, a bit different. In a way, it is more flexible which might in terms of security not be the best outcome. Nevertheless, let's se what we can do. Since you are passing the basketId
as one of the data
arguments we could check if a basket
with such id and our user as an owner exists. This is very similar to Graphcool approach if you ever used Graphcool Framework.
A quick code example might be something like this;
const isOwnerOfTheBasket = rule()(async (parent, args, ctx, info) => {
const basketID = args.data.basketID
const userID = ctx.user.id
return ctx.db.exists.Basket({
id: basketID,
owner: { id: userID }
})
})
If you are not yet familiar with Graphcool like permissions approach, I encourage you to read the old permissions docs and learn as much as possible from the idea. To give you a bit of headstart, permission queries have been renamed to .exists
in Prisma.
https://www.graph.cool/docs/reference/auth/authorization/overview-iegoo0heez
To answer your last two questions, yes! Both args
, and ctx
are forwarded to your rule
from the present field resolver. What I mean by "present" is that you have to take into account that args
differ from field to field and are not the same throughout the query execution.
Hope this answers your question! 🙂
Also, if you have some time, please open up another issue with feature/docs request for example with graphql-middleware-forward-binding
, or even better create a PR with your case! 🎉
from graphql-shield.
Perfect! I think that example code will work well :)
from graphql-shield.
Related Issues (20)
- Execute root fields rules prior graphql execute phase
- Add the ability to use Fragments and post-execution rules with the single server/schema
- Add Typescript typings to rule args
- Add the ability to attach rules using GraphQL Directives
- CI: add codecov reports
- Provide a way to expose authorization metadata through the graphql schema
- GraphQL Shield Roadmap
- 7.6.4 ESM build broken HOT 5
- Documentation website down HOT 1
- How to use `if` condition in GraphQL Shield HOT 2
- Shield rules type generation based on schema HOT 1
- Feature request: wildcard functionality for field names
- Update [email protected] module to avoid @types/lodash and babel runtime in production deps
- fallbackError loses custom error types
- fallbackRule context information HOT 2
- Question: Is there a way to return objects on rules?
- ..
- Typo in the Docs
- Shield permissions only working properly with 'debug: true' HOT 1
- Performance -- every field wrapped is unnecessarily wrapped in a promise HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from graphql-shield.