Adding rules to a type and its fields

Question about GraphQL Shield

Let’s say I have a type User in my GraphQL schema, and I want to limit all queries on that type to those that match some isAuthenticated rule. But within this User type, I also have a secret field, which I want to further restrict with an additional isAdministrator rule. Is there any way to list both type-wide and field-specific rules if the two overlap, or would I need to enumerate all of the fields in User to explicitly add the isAuthenticated rule for each?

• I have checked other questions and found none that matches mine.

[ph55]

It is easily achieved by defining custom fallbackRule.

In following example, deny queries and mutations which have no rules but allow types and fields. So once you have rule that allows Query or Mutation you don’t have to add rule for returned type and (or) it’s fields.

const shieldFallback = async (parent, args, ctx, info) => {
    switch (info.parentType.name) {
      // queries
      case 'Query':
        return false;
      // mutations
      case 'Mutation':
        return false;
      // returned types and it's fields
      default:
        return true;
    }
};
const fallbackRule = rule({ cache: false })(shieldFallback);

const ruleTree = { Query: {}, Mutation: {} };
const permissions = shield(ruleTree, { fallbackRule });

You can play further with fallback for your needs.

[maticzav]

@LK let’s think of the options we have. I think I understand why such functionality could be beneficial, however, I am struggling to find the right approach. My primary goal of this conversation is to understand the use case we are trying to solve and propose a meaningful solution to the problem which won’t pose a holdback in the future.

A few concerns that I have:

1. We shouldn’t split fallbacks with permissions because it doesn’t scale on large systems.
2. We should apply a logic rule when extending default with a particular rule.

My proposal:

declare function extend(rule: ShieldRule, fieldMap: IRuleFieldMap): IRuleFieldMap

const houseType = extend(allow, {
  inquiries: isUserOwner,
})

which would reduce to

const houseType: IRuleFieldMap = {
  id: allow,
  name: allow,
  price: allow,
  inquiries: and(allow, isUserOwner),
}

A few open questions that I have:

1. What kind of logic rule should we use?
2. How does global fallbackRule work?
3. What should be the name of the function?
4. Should we omit fallbackRule altogether in favour of extend which could also accept IRules as an argument, or should we keep it narrowed down to types only?

cc @ph55