Clojurians Log v2

I was wondering about this too, is calling a parser from within a mutation the correct approach for e.g. resolving some permission keywords that need to be taken into account? Or is there a better approach to resolve some contextual information during a mutation?

@thomasmoerman Perhaps your use case is more specific but in our mutations we'll typically return a map that has, at least, a /id attribute that a pathom resolver takes as an input. Pathom will then resolve any additional keys through the regular facilities.

My case is different: the idea is to call the parser to use the existing resolvers to resolve additional (e.g. permission) info that might prevent the mutation from executing. So it's not a mutation join using an /id return value, as you mention.

Could you alter the query prior to calling the parser?

@thomasmoerman it’s generally fine, but you should beware of calling parser with the current env, as it can be modified via open idents by the user [1]. there’s some discussion on auth best practices [2] [1] https://github.com/souenzzo/eql-style-guide#security [2] https://github.com/souenzzo/eql-style-guide/issues/4

Thanks, i'll look into it.

Ok I think I understand it now, that's indeed a subtle vulnerability that I did overlook tbh... many thanks for pointing that out