@lyvly/graphql-compose-auth-middleware

graphql-compose-auth-middleware

Provides custom middleware that can be used to authorize your services.

Motivation

We use these authorizers everywhere to ensure that our various GraphQL resolvers can only be accessed by the correct people with the correct authorizers. We thought it would be a good idea to expose these simple authorizers for you to gain inspiration from or to use in your project.

Usage

To use this library, add the main authorize function as middleware to your resolver definition in the schemaComposer and then pick any of our authorizers or write your own that follows our spec!

_Note: authorize() currently works on a first past the post system, the first authorizer that succeeds will be the context used for the rest of that request, it is advisable to order your authorizers from least privilege to most privilege at this time`

Feel free to open a PR and suggest a better or different way of doing things!

Example usage of one of our authorizers here

import { authorize, customScopeAuthorizer } from '@lyvly/graphql-compose-auth-middleware';

schemaComposer.Mutation.addFields({
  memberCreateOne: MemberTypeComposer.getResolver('memberCreateOne', [
    authorize([customScopeAuthorizer('yourScope')]),
  ]),
});

Custom scope authorizer

The custom scope authorizer interrogates context.claims.scope, which is expected to be an array. It takes in a scopeName parameter for the scope you wish to allow access to your resolver.

customScope(scopeName)

Filter By Claim Value authorizer

The filter by claim value authorizer interrogates context.claims[claimName]. If it exists, the claim value is passed down to the resolver via a filter argument with the filterName as the key for the filter.

filterByClaimValue(claimName, filterName)

Group authorizer

The group filter interrogates context.claims[claimName], which is expected to be an array. It then checks to see if the groupName is included within the above interrogated value.

group(claimName, groupName)

Authorizer specification

Our spec is very simple, simply create a standard graphql-compose middleware function and utilise the data inside to determine whether someone is authorized or not. Then return an object with a property of the name authorized as a boolean, and if true the 4 graphql-compose arguments are required as well.

Pass that function to authorize() as shown in the example at the top and you should be good to go!

Take a peek at some of our authorizers if you want to see an example of passing parameters into the authorizer as well.

export const yourAuthorizer = (source, args, context, info) => {
  if (falseCondition) {
    return { authorized: false };
  }

  return {
    authorized: true,
    source,
    args,
    context,
    info,
  };
};