Authorization and Permission Handling

We’re going to move the auth logic into a separate file which will be easier for people to add their own custom auth logic to. We also need to add permission handling here, though we’re not sure on the best way to do permission verification w/ GraphQL.

Perhaps each resolve function for collections include required permissions and those are passed into the authorize method, like this: authorize(token, requiredPermissions). The JWToken can contain permissions within it. These will be checked against the permissions hardcoded in each resolve function via an authorize method.

Do you have any thoughts on this?

cc @pmuens @minibikini @eahefnawy @breandr

[brettstack]

Something like this?

//authorize.js
function authorize(jwt, requiredPermissions) {
    if(/*jwt contains requiredPermissions*/) {
        return Promise.resolve()
    }

    return Promise.reject(/*[missingPermissions]*/)
}

//users/queries.js
resolve: (source, {jwt, username}) => authorize(jwt, ['GET_USER']).then(() => get(username))

Is there somewhere higher up we can do auth so that we don’t need to add the authorize(jwt, ['GET_USER']).then(() => boilerplate to each resolve? Instead if we could add requiredPermissions: ['GET_USER'] on the query object… But my knowledge of GraphQL fails me.

[eahefnawy]

Good thoughts! So what that would mean is that the createUser function will add a permissions array to the user dynamoDB record based on the role that is provided by the query (when you sign up you’ll choose whether to be an admin or not…maybe?), and the loginUser function will take that record and inject it in the jwt token.

I guess that makes sense.