Granular security for Update about graphql

[darrellwarde]

Hi, field level auth is supported: https://neo4j.com/docs/graphql-manual/current/auth/authorization/allow/#_field_level_allow

If it is attempted to update that field without authorization, the entire request will error.

[Kubera2017]

Yes, but how to allow view, but deny update? What we need is some kind of this logic:
@auth(read: [reader, admin], update: [admin])

[darrellwarde]

Yes, but how to allow view, but deny update? What we need is some kind of this logic:
@auth(read: [reader, admin], update: [admin])

That is possible, your syntax is not quite right:

@auth(
  rules: [
    {
      operations: [READ],
      roles: ["reader", "admin"]
    },
    {
      operations: [UPDATE],
      roles: ["admin"]
    }
  ]
)

The above would be akin to the example you gave there.

I recommend reading our docs on auth to more fully understand the directive: https://neo4j.com/docs/graphql-manual/current/auth/