graphql

hlship 2019-04-19T17:57:39.001600Z

I just pushed 0.33.0-alpha-2 to clojars. Feedback would be most welcome!

2019-04-19T21:16:36.003100Z

Re the auth question: Is it possible to decorate the schema in some way that it is apparent to callers what they can and cannot do. I know that in graphql-ruby you can hide fields from introspection, but that seems overly agressive

hlship 2019-04-22T16:29:34.004100Z

I'm still figuring out what to do with directives; we have them in the schema and validated, but I haven't quite figured out the right way to expose them to user code. Perhaps yet another key in the context.

hlship 2019-04-22T16:30:13.004300Z

Ideally, the internal If and Unless directives would be implemented the same as user-defined directives, but I don't see a good way to do that yet.

hlship 2019-04-22T16:30:45.004500Z

So, in theory, you could use directives to describe auth, but in practice, Lacinia doesn't quite let you.

2019-04-22T16:55:30.006800Z

@jvtrigueros Right, we have a structure akin the viewer, but some of our types have fields that are restricted. So there are fields that you as a client see, but not necessarily can access.

2019-04-22T16:56:56.008600Z

Thanks for the explanation, @hlship, looking forward to when you guys do figure it out!

timgilbert 2019-04-23T19:14:18.008800Z

About your original question, you can do a good deal of schema decoration by arguments to resolver literals, though you do need to roll your own conventions. Eg

{ :projects {:type :ProjectList :resolve [:resolvers/projects {:user/required-role :user.role/admin}]}}
}}}

timgilbert 2019-04-23T19:15:08.009200Z

...then you'd need to implement the resolver that checks for :user/required-role and returns either the right object or nil

2019-04-24T05:52:46.009400Z

That would be decoration on the server side then I’d assume? I was more looking at decorating fields in such a way that a client knows that asking for them is futile. E.g. lets say that you need to have Admin role to retrieve anyones credit card number (please don’t do this)

2019-04-19T21:17:50.003200Z

we were looking at directives, but… we couldn’t figure out how

2019-04-19T22:12:08.003400Z

When I was dealing with authz, I remember reading about the viewer field which is used to determine the relationship between viewer and other nodes. This does require re-structuring of the types though. https://medium.com/workflowgen/graphql-schema-design-the-viewer-field-aeabfacffe72