can_create_object? permission location about action_policy-graphql

[palkan]

Usually, I add such fields to the parent type, for example:

module Types
  class Room < Base
     # whether user is allowed to send messages to this chat room 
     expose_authorization_rules :create?, with: MessagePolicy, field_name: :can_create_messages
  end
end

The top-level parent could be me (or viewer) type.

[dmitry]

We are doing the same. Alternatively you can use plain allowed_to? if authorization rules are too big for you:

      field :can_manage_jobs, Boolean, null: false
      def can_manage_jobs
        allowed_to?(:manage?, ::Job)
      end