Authentication and Autherization for subscriptions

First of all thanks for this amazing library. Thanks a lot. The docs for authorization in Apollo docs suck

I have a doubt, is it possible to authorize subscriptions using graphql-shield? Mutations are also possible, right?

[styk-tv]

@maticzav can we please keep this open? subscriptions are fundamental to graphql. having this library admit access on subscription level is of paramount importance to quite large audience from apollo/yoga crowds.

isAuthenticate rule is being hit during subscription access evaluation. however no way to whitelist the specific

Error: Not Authorised!
    at normalizeOptions (/Users/polfilm/git_madstat/api-apollo/app/node_modules/graphql-shield/src/shield.ts:25:32)
    at shield (/Users/polfilm/git_madstat/api-apollo/app/node_modules/graphql-shield/src/shield.ts:43:29)
    at Object.<anonymous> (/Users/polfilm/git_madstat/api-apollo/app/src/permissions.js:25:35)
    at Module._compile (internal/modules/cjs/loader.js:688:30)
    at Module._compile (/Users/polfilm/git_madstat/api-apollo/app/node_modules/pirates/lib/index.js:83:24)
    at Module._extensions..js (internal/modules/cjs/loader.js:699:10)
    at Object.newLoader [as .js] (/Users/polfilm/git_madstat/api-apollo/app/node_modules/pirates/lib/index.js:88:7)
    at Module.load (internal/modules/cjs/loader.js:598:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:537:12)
    at Function.Module._load (internal/modules/cjs/loader.js:529:3)

So evaluation of authorization is not taken under consideration.

[navigui]

I managed to get ride of this issue in graphql-yoga the problem is not in the shield library, but in the way to handle the access token the rule : isAuthenticated in grapql-yoga for example uses the function

export  function getUserId(context: Context) {
  const Authorization = context.request.get('Authorization')
  if (Authorization) {
    const token = Authorization.replace('Bearer ', '')
    const verifiedToken = verify(token, APP_SECRET) as Token
    return verifiedToken && verifiedToken.userId
  }
}

it seams that the request property of the context is not accessible from subscriptions to get the user id you have to use another property which is “connection” the Authorization status can be accessible from it, so this code works fine for me

export function getUserIdForSubscriptions (context : Context) {
  const Authorization = context.connection.context.Authorization
  if (Authorization) {
    const token = Authorization.replace('Bearer ', '')
    const verifiedToken = verify(token, APP_SECRET) as Token
    return verifiedToken && verifiedToken.userId
  }
}

don’t forget to declare it in the interface of the context

import { PubSub } from 'graphql-yoga'
import { ContextParameters } from 'graphql-yoga/dist/types'

export const pubSub = new PubSub()

export interface Context {
  connection : any
  request: any
  pubSub : PubSub,
}

export function createContext(request: ContextParameters) {
  return {
    ...request,
    pubSub,
    db
  }
}

hope this will help