Graphql Auth

auth-1.js

const checkScropeAndResolve = (scope, expectedScope, controller) => {
  const hasScope = scope.includes(expectedScope)
  if (! expectedScopes.length || hasScope) {
    return controller.apply(this)
  }
}

const controller = model.getArticles(context.user.id)

const resolvers = {
  Query: {
    articlesByAuthor: (_, args, context) =>
      checkScopeAndResolve(
        context.user.scope,
        ['read:articles'],
        controller
      );
  }
}

auth-2.js

import { createError } from 'apollo-errors'
import jwt from 'jsonwebtoken'

const AuthorizationError = createError('AuthorizationError', {
  message: 'You are not authorized!'
})

const checkScropeAndResolve = (context, expectedScope, controller) => {
  const token = context.headers.authorization
  
  try {
    const jwtPayload = jwt.verify(token.replace('Bearer ', ''), secretKey)
    const hasScope = jwtPayload.scope.includes(expectedScope)
    
    if (! expectedScopes.length || hasScope) {
      return controller.apply(this)
    }
  } catch (err) {
    throw new AuthorizationError()
  }
}

const controller = model.getArticles(context.user.id)

const resolvers = {
  Query: {
    articlesByAuthor: (_, args, context) =>
      checkScopeAndResolve(
        context,
        ['read:articles'],
        controller
      );
  }
}

auth-directives.js

// What if we want to limit access to certain fields like `email`, etc.
// github.com/chenkie/graphql-auth

const typeDefs = `
directive @isAuthenticated on QUERY | FIELD
directive @hasScope(scope: [String]) on QUERY | FIELD

type Article {
  id: ID!
  author: String!
  reviewerComments: [ReviewerComment] @hasScope(scope: ["read:comments"])
}

type Query {
  allArticles: [Article] @isAuthenticated
}
`

const directiveResolvers = {
  isAuthenticated(result, source, args, context) {
    const token = context.headers.authorization
    // ...
  },
  hasScope(result, source, args, context) {
    const token = context.headers.authorization
    // ...
  }
}

const attachDirectives = schema => {
  forEachField(schema, field => {
    const directives = field.astNode.directives
    directives.forEach(directive => {
      // ...
    })
  })
}