Clojurians Log v2

hello all, how do you deal with authentication ?

I thought using a mutation login that after check user and password return a token that will pass in all queries. Is that a good way to do this?

We just pass an Authentication header, with a JWT that you got from an oauth provider

You can pass a connection-init-payload with Apollo or re-graph, and lacinia-pedestal can handle it

Regarding https://lacinia.readthedocs.io/en/latest/directives.html… I use JWT for login/access control and in the token’s claims there are the roles assigned to the user. I used GraphQL directives to attach roles to queries and mutations and I’d like to check them before executing the resolver. Within the resolver I can access the directive defined in the schema:

(->> context
     :com.walmartlabs.lacinia/selection
     :field-definition
     :directives
     (filter #(= :access (:directive-type %)))
     first
     :directive-args
     :roles)

:directives [{:directive-type :access
              :directive-args {:roles ["admin"]}

Feels like this needs a Lacinia enhancement; selections-seq2 could expose field-level directives.