graphql-api 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 95f514ccff92debe339818cb597bb3be03a46537
-  data.tar.gz: 7032b93c8e4c5abefdf09e434ad01ef9f6c2fb01
+  metadata.gz: d066b645b42c6471423c84254b296abe806d8bda
+  data.tar.gz: dcbc217929b63f258c12c63f392b373acbe6d9dd
 SHA512:
-  metadata.gz: 207a89f484b7dab769130910326067f0fa08bc0b83b843c28cb577ae952c631b3ce024c5c2b5e160b43107bc82870b2c53567432fa6b4897add62a77e6addb93
-  data.tar.gz: bf7290f3e1397193d4d14edc4d456508f4270dc8195bb74701428475a9b27f6f576490947de824470d786f437a95720de66d607ca0e178ae357d0c496b3596ad
+  metadata.gz: e3b258f21b2d9d8d5de142659f3334c22d37ec2cf260c448dc6cb166b2461d22bb46ba033a65b2738e5258ee99b4f5e1a0fa4bd82fba6dc9a42d727e1c8718aa
+  data.tar.gz: eb187d750c57364262bccc79ac107fd331de3c34e51bdc625f1d5003b0a0491863376d57f50051d416c3a3d8ced201ed210f8f348497a87fcbc4507ad2d49908

data/README.md

@@ -1,6 +1,6 @@
 # GraphQL-Api
-GraphQL-Api is an opinionated Graphql framework for Rails that supports 
-auto generating queries based on Active Record models and plain Ruby 
+GraphQL-Api is an opinionated Graphql framework for Rails that supports
+auto generating queries based on Active Record models and plain Ruby
 objects.
 
 ## Example
@@ -93,46 +93,43 @@ class GraphqlController < ApplicationController
   # will respond to graphql requests and pass through the current user
   def create
     render json: GraphSchema.execute(
-        params[:query], 
-        variables: params[:variables] || {}, 
+        params[:query],
+        variables: params[:variables] || {},
         context: {current_user: current_user}
     )
   end
-  
+
 end
 ```
 
 ### Authorization
 
-GraphQL-Api will check for an `access_<field>?(ctx)` method on all model 
-objects before returning the  value. If this method returns false, the 
+GraphQL-Api will check for an `access_<field>?(ctx)` method on all model
+objects before returning the  value. If this method returns false, the
 value will be `nil`.
 
-To scope queries for the model, define the `graph_find(args, ctx)` and 
+To scope queries for the model, define the `graph_find(args, ctx)` and
 `graph_where(args, ctx)` methods using the `ctx` parameter to get the
 current user and apply a scoped query. For example:
 
 ```ruby
 class Blog < ActiveRecord::Base
   belongs_to :author
-  
+
   def self.graph_find(args, ctx)
     ctx[:current_user].blogs.find(args[:id])
   end
-  
+
   def access_content?(ctx)
     ctx[:current_user].is_admin?
   end
-  
+
 end
 ```
 
 For more complicated access management, define query objects and Poro's
 with only a subset of fields that can be accessed.
 
-Future work is this area is ongoing. For example, a CanCan integration 
-could be a much simpler way of separating out this logic.
-
 ## Documentation
 
 ### Querying
@@ -151,14 +148,39 @@ you can pass them in directly to the new command.
 
 ### Policy Objects
 
-Policy objects can be instantiated for accessing models. These objects
-should meet the following interface methods.
+Policy objects can be created for controlling access to fields of a model.
+This enables you to provide a DRY solution for controlling access to granular
+attributes of models and PORO's.
 
-##### CRUD Policies
+The policy object is defined as follows, with the naming convention following
+the pattern `{Model}Policy`.
+```ruby
+class UserPolicy < GraphQL::Api::Policy
 
-The policy object should return true or false methods for all of the crud
-options allowing the mutation to take place, ie
+  def read?
+    # model is the instance, user is the current_user
+    user.role == 'admin' || user.id == model.id
+  end
 
+end
+```
+There are four key methods that represent the CRUD operations:
+- `read?`
+- `create?`
+- `update?`
+- `destroy?`
+
+These are checked by the default resolvers created by GraphQL-Api
+before the mutations or queries take place. Additionally, for control
+over access to fields, you may define a method on the policy with the
+following form:
+
+    access_{field}?
+
+If this method exists, the policy will be consulted before reading the
+field. You can control the response behaviour by overriding the
+`unauthorized_field_access(field_name)` method on the policy object.
+By default it will return nil.
 
 ### Model Objects
 
@@ -175,7 +197,7 @@ relationship is set up. Column types are also inferred.
 
 GraphQL-Api will set up two queries on the main Graphql query object. One for
 a single record and another for a collection. You can override these queries
-by setting a `graph_find(args, ctx)` and `graph_where(args, ctx)` class 
+by setting a `graph_find(args, ctx)` and `graph_where(args, ctx)` class
 methods on your model. The `ctx` parameter will contain the context passed
 in from the controller while the `args` parameter will contain the arguments
 passed into the graphql query.
@@ -183,7 +205,7 @@ passed into the graphql query.
 #### Poro
 
 Plain old ruby objects are supported by implementing a class method called
-`fields` on the object that returns the expected [types](#types) hash. 
+`fields` on the object that returns the expected [types](#types) hash.
 Methods on the Poro should be defined with the same name as the provided
 fields.
 
@@ -206,7 +228,7 @@ below will create a `updateBlogCommand` mutation as well as a `deleteBlogCommand
 class BlogCommand < GraphQL::Api::CommandType
   inputs name: :string, tags: [:string], id: :integer
   returns blog: Blog
-  
+
   # this tells GraphQL-Api to make two mutations that call the below methods.
   actions :update, :delete
 
@@ -262,8 +284,8 @@ docs for how to do this.
 
 ### Types
 
-Field types and argument types are all supplied as a hash of key value 
-pairs. An exclamation mark at the end of the type marks it as required, 
+Field types and argument types are all supplied as a hash of key value
+pairs. An exclamation mark at the end of the type marks it as required,
 and wrapping the type in an array marks it as a list of that type.
 
 ```ruby
@@ -289,7 +311,6 @@ Note, these are the same as active record's column types for consistency.
 ## Roadmap
 
 - [ ] Customizing resolvers
-- [ ] CanCan support
 - [ ] Relay support
 - [ ] Additional object support (enums, interfaces ...)
 - [ ] Support non rails frameworks

data/lib/graphql/api/policy.rb

@@ -29,8 +29,12 @@ module GraphQL::Api
       true
     end
 
-    def unauthorized!(msg=nil)
-      raise UnauthorizedException.new(msg)
+    def unauthorized!
+      raise UnauthorizedException.new
+    end
+
+    def unauthorized_field_access(name)
+      nil
     end
 
   end

data/lib/graphql/api/resolvers/field.rb

@@ -10,15 +10,14 @@ module GraphQL::Api
 
       def call(obj, args, ctx)
         if @policy_class
-          policy = @policy_class.new(ctx[:current_user], obj, ctx)
-          return nil unless policy.read?
+          policy = @policy_class.new(ctx, obj)
+          return policy.unauthorized! unless policy.read?
 
           if policy.respond_to?("access_#{@name}?")
-            obj.send(@name) if policy.send("access_#{@name}?")
-          else
-            obj.send(@name)
+            return policy.unauthorized_field_access(@name) unless policy.send("access_#{@name}?")
           end
-          obj.send(@name) if policy.respond_to?("access_#{@name}?")
+          
+          obj.send(@name)
         elsif obj.respond_to?("access_#{@name}?")
           obj.send(@name) if obj.send("access_#{@name}?", ctx)
         else

data/lib/graphql/api/resolvers/model_create_mutation.rb

@@ -9,10 +9,8 @@ module GraphQL::Api
 
       def call(inputs, ctx)
         if @policy_class
-          policy = @policy_class.new(ctx[:current_user], nil, ctx)
-          unless policy.create?
-            return {key => nil}
-          end
+          policy = @policy_class.new(ctx, nil)
+          return policy.unauthorized! unless policy.create?
         end
 
         item = @model.create!(inputs.to_h)

data/lib/graphql/api/resolvers/model_delete_mutation.rb

@@ -11,10 +11,8 @@ module GraphQL::Api
         item = @model.find(inputs[:id])
 
         if @policy_class
-          policy = @policy_class.new(ctx[:current_user], item, ctx)
-          unless policy.destroy?
-            return {key => nil}
-          end
+          policy = @policy_class.new(ctx, item)
+          return policy.unauthorized! unless policy.destroy?
         end
 
         item.destroy!

data/lib/graphql/api/resolvers/model_find_query.rb

@@ -15,10 +15,8 @@ module GraphQL::Api
         end
 
         if @policy_class
-          policy = @policy_class.new(ctx[:current_user], item, ctx)
-          unless policy.read?
-            return nil
-          end
+          policy = @policy_class.new(ctx, item)
+          return policy.unauthorized! unless policy.read?
         end
 
         item

data/lib/graphql/api/resolvers/model_list_query.rb

@@ -4,6 +4,7 @@ module GraphQL::Api
 
       def initialize(model)
         @model = model
+        @policy_class = "#{model.name}Policy".safe_constantize
       end
 
       def call(obj, args, ctx)
@@ -20,7 +21,16 @@ module GraphQL::Api
 
           q = @model.where(query_args)
           q.eager_load(*eager_load) if eager_load.any?
-          q.limit(args[:limit] || 30)
+          results = q.limit(args[:limit] || 30)
+
+          if @policy_class
+            results.each do |res|
+              policy = @policy_class.new(ctx, res)
+              return policy.unauthorized! unless policy.read?
+            end
+          end
+          
+          results
         end
       end
 

data/lib/graphql/api/resolvers/model_update_mutation.rb

@@ -11,10 +11,8 @@ module GraphQL::Api
         item = @model.find(inputs[:id])
 
         if @policy_class
-          policy = @policy_class.new(ctx[:current_user], item, ctx)
-          unless policy.destroy?
-            return {key => nil}
-          end
+          policy = @policy_class.new(ctx, item)
+          return policy.unauthorized! unless policy.destroy?
         end
 
         item.update!(inputs.to_h)

data/lib/graphql/api/version.rb

@@ -1,5 +1,5 @@
 module GraphQL
   module Api
-    VERSION = '0.1.5'
+    VERSION = '0.1.6'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: graphql-api
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Colin Walker
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-11-17 00:00:00.000000000 Z
+date: 2017-01-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails