graphql-armory 0.1.0.pre

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 9bb288f28bfb93054aa3ff328b791ff7936dfb546d289671650bd19182b56177
+  data.tar.gz: 44d9b064622b91a9691499d48df611f4b544950fbbbdf8a49d470c7563c41a03
+SHA512:
+  metadata.gz: 4bc8f032f4f5305cfe298542ab63a7f0fac65118abb9011ee4af5fc48f7ddf66886b8cb11ac2ae300a296d0facd3a033e20e06daf23462b667bc9017d3dbea51
+  data.tar.gz: 87c9adeafec6dd55dcb8f3cc597e941afff6bab620d6e38ebcc4a4a9880bdfc8200c9fd926c36f67badfa1520dd61f416f86563a68fc164217e19c218105729e

data/CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+## Unreleased
+
+- Interfaces and unions: an interface field with no rule is denied when an implementing type is a bypass, and the audit
+  reports it; `include Base` in an interface or union is refused with a pointer to the possible types.
+
+- Mutations and resolvers: `authorize :action, model:, on_denied:` on a mutation or resolver that includes `Base`. Denied by
+  default when it declares no rule; the rule runs on the loaded records; `on_denied: :errors` answers as data;
+  `covers_fields: true` lets a payload type be covered by its mutation. The audit lists mutations with no rule.
+
+- Argument rules: `authorize: :action`, `visible_when:` and `authorize: :none, reason:` on arguments. An argument with no rule
+  is covered by its field; a declared rule is checked when the client sends it and a denial denies the field.
+
+- Visibility driven by the policy: `authorize :read, visible_when: :export` on a type and `visible_when:` on a field hide
+  them from introspection and error suggestions. A schema dump needs `context: { armory_full_schema: true }`.
+
+- CanCanCan adapter (`adapter: :cancan`): `can?` with the field attribute, `accessible_by` for relations, and
+  `MissingScopeError` for block-only rules unless the type declares `authorize :read, scope: :in_memory`.
+
+- Black-box security suite (`spec/security`), runnable example (`examples/invoices.rb`), benchmark,
+  README and MIGRATING guide.
+- Execution::Next is supported from graphql 2.6.2: in 2.5.26 to 2.6.1 a denied field crashes the engine.
+  The integration refuses to run there.
+- Gem skeleton: gemspec, Docker test image, RSpec with an execution-engine switch
+  (`GRAPHQL_ARMORY_ENGINE=interpreter|next`) and a CI matrix.

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Israel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/MIGRATING.md

@@ -0,0 +1,85 @@
+# Migrating from manual `authorized?`
+
+The usual hand-written setup has three weak spots: every type needs its own `authorized?`, a forgotten type is open, and lookups by ID skip the check. This guide moves them to graphql-armory one step at a time. Each step leaves the app working.
+
+## 1. Install the plugin and the bases
+
+```ruby
+class AppSchema < GraphQL::Schema
+  use GraphQL::Armory::Authorization, adapter: :pundit
+end
+```
+
+Make your base classes include `GraphQL::Armory::Authorization::Base` (see the README quick start). Types that inherit from them are now covered; run the audit to see the rest.
+
+## 2. Replace `authorized?` with a rule
+
+Before:
+
+```ruby
+class InvoiceType < BaseObject
+  def self.authorized?(object, context)
+    super && InvoicePolicy.new(context[:current_user], object).read?
+  end
+end
+```
+
+After: delete the method. `default_action :read` on the base (or `authorize :read` on the type) asks the same `InvoicePolicy#read?`.
+
+## 3. Replace `scope_items` and list resolvers
+
+Before:
+
+```ruby
+def self.scope_items(items, context)
+  InvoicePolicy::Scope.new(context[:current_user], items).resolve
+end
+```
+
+After: delete it. Lists of the type go through `InvoicePolicy::Scope` automatically, before pagination.
+
+## 4. Replace lookups by ID
+
+Before:
+
+```ruby
+field :invoice, InvoiceType do
+  argument :id, ID
+end
+def invoice(id:) = Invoice.find(id)          # IDOR: any ID works
+```
+
+After:
+
+```ruby
+field :invoice, InvoiceType, authorize: :none, reason: "looked up through the scope", find_by: :id do
+  argument :id, ID
+end
+```
+
+For `loads:` arguments nothing changes in your code: they now resolve inside the scope. Another tenant's ID answers like a missing record.
+
+## 5. Declare field-level rules
+
+```ruby
+field :internal_notes, String, authorize: :manage
+```
+
+A field with no rule on a bypassed type is denied until it declares one.
+
+## 6. Make CI watch
+
+```ruby
+expect(AppSchema).to be_fully_authorized
+```
+
+## Check your migration
+
+- The audit reports no problems, and every bypass has a reason you can defend.
+- A test per sensitive type: user A asks for user B's record by root field, association and `loads:`; the answer matches a missing record.
+- Policies return `true`/`false`/`nil` only.
+
+## Known differences
+
+- Arguments, mutations, interfaces and unions are not covered yet; keep your manual checks there.
+- Policies without a `Scope` class are flagged by the audit for every type that uses them.

data/README.md

@@ -0,0 +1,311 @@
+<p align="center">
+  <img src="assets/logo.jpeg" alt="graphql-armory" width="560">
+</p>
+
+# graphql-armory
+
+Open-source extensions for [graphql-ruby](https://github.com/rmosolgo/graphql-ruby), built on its public extension points: no fork, no monkey patching.
+
+The first module is **authorization**. It plugs [Pundit](https://github.com/varvet/pundit) policies into graphql-ruby so that:
+
+- **Nothing is open by default.** A type or field no rule covers answers `null` (or an error), never data.
+- **Lists only contain what the user may see**, including connections: the scope runs before pagination and counting.
+- **Lookups by ID cannot leak** (IDOR). A record you may not read and a record that does not exist look identical.
+- **An audit tells you what you forgot**, from a rake task or an RSpec matcher, so CI fails instead of production leaking.
+
+> **Status: early development (0.1, unreleased).** Pundit and CanCanCan adapters. Not published yet.
+
+## Install
+
+```ruby
+gem "graphql-armory"
+gem "pundit"      # or "cancancan", whichever you use
+```
+
+Requires Ruby >= 3.1 and graphql >= 2.4. `GraphQL::Execution::Next` is supported from graphql 2.6.2 (see [Engines](#engines)).
+
+## Quick start
+
+Your policies stay plain Pundit. The only new thing is where the rules are declared:
+
+```ruby
+class BaseField < GraphQL::Schema::Field
+  include GraphQL::Armory::Authorization::Base
+end
+
+class BaseObject < GraphQL::Schema::Object
+  include GraphQL::Armory::Authorization::Base
+  field_class BaseField
+  default_action :read          # every type is checked with InvoicePolicy#read?, AccountPolicy#read?...
+end
+
+class InvoiceType < BaseObject
+  field :number, String, null: false
+  field :internal_notes, String, authorize: :manage   # this field asks InvoicePolicy#manage?
+end
+
+class QueryType < BaseObject
+  authorize :none, reason: "root type; each field declares its own rule"
+  field :invoices, [InvoiceType], null: false, authorize: :none, reason: "narrowed by InvoicePolicy::Scope"
+end
+
+class AppSchema < GraphQL::Schema
+  query QueryType
+  use GraphQL::Armory::Authorization, adapter: :pundit
+end
+```
+
+The actor is `context[:current_user]`. A complete, tested version lives in [`examples/invoices.rb`](examples/invoices.rb).
+
+### Rules
+
+| Declaration | Meaning |
+|---|---|
+| `default_action :read` | Default rule for every type below this base class. |
+| `authorize :manage` | This type is checked with `manage?` instead. |
+| `authorize :read, model: Invoice` | The model when it is not named like the type. |
+| `field ..., authorize: :manage` | The field asks another question of the same policy. |
+| `authorize :none, reason: "..."` | Explicit bypass. A reason is required and appears in the audit. |
+
+A bypass does not propagate: a field of a bypassed type still needs its own rule, or it is denied.
+
+### What happens on denial
+
+```ruby
+use GraphQL::Armory::Authorization, adapter: :pundit, on_unauthorized: :null # default
+```
+
+| Mode | Client sees | Use |
+|---|---|---|
+| `:null` | `null`, no error | Default. Reveals nothing. |
+| `:error` | `"Not found"`, code `NOT_FOUND`, identical on every path | When clients need to tell. |
+| `:raise` | `NotAuthorizedError` naming only the type | When your app rescues it. |
+
+Denied non-null fields raise the generic "Not found" error, because GraphQL cannot return `null` there (on Execution::Next a denied object in a non-null position answers graphql-ruby's own "Cannot return null for non-nullable field", and `:raise` messages are prefixed with the field path). `find_by:` lookups always answer `null` in every mode: a missing ID cannot raise, and a foreign ID must look the same.
+
+### Lists, connections and lookups
+
+Lists of a type are narrowed through `InvoicePolicy::Scope` (relations) or by calling the policy per item (arrays). Return a relation when you can: SQL filters before Ruby sees anything.
+
+```ruby
+field :invoice, InvoiceType, authorize: :none, reason: "looked up through the scope", find_by: :id do
+  argument :id, ID
+end
+
+field :invoice_via_ref, InvoiceType, authorize: :none, reason: "loaded through the scope" do
+  argument :invoice_id, ID, loads: InvoiceType
+end
+```
+
+`find_by:` and `loads:` look the record up **inside the user's scope**, so another tenant's ID answers exactly like a missing one. Opt out of the scope for a `loads:` only on purpose, with `load_through_scope: false`; the audit lists it.
+
+## The audit
+
+```ruby
+GraphQL::Armory::Authorization::Audit.(AppSchema)   # => report with problems
+```
+
+```ruby
+# spec/schema_spec.rb
+require "graphql/armory/authorization/rspec"
+expect(AppSchema).to be_fully_authorized
+```
+
+```ruby
+# Rakefile (or a Rails task file): exits 1 when anything is uncovered
+load "tasks/graphql_armory.rake"
+# bundle exec rake "graphql_armory:audit[AppSchema]"
+```
+
+It reports types nobody protects (a base class that never included `Base`), types and fields with no rule, policies missing the method or `Scope`, `loads:` that skip the scope, and lists every declared bypass with its reason.
+
+## CanCanCan
+
+Same schema, different adapter. Your types and fields do not change:
+
+```ruby
+use GraphQL::Armory::Authorization, adapter: :cancan
+```
+
+The actor is `context[:current_ability]` (it wins over `current_user`), or `Ability.new(context[:current_user])` (pass `Adapters::CanCan.new(ability_class: MyAbility)` for another class). It is built once per query.
+
+| Question | CanCanCan call |
+|---|---|
+| Can this object be seen? | `ability.can?(:read, object)` |
+| Can this field be seen? | `ability.can?(:manage, object, :internal_notes)` for a field that declares `authorize: :manage`: the attribute is passed, because `can :read, User, [:username]` makes `can?(:read, user)` true for the whole object |
+| Which items of a list? | `Model.accessible_by(ability, :read)`, still a paginable relation; Arrays are filtered with `can?` |
+
+**Block-only rules.** `can(:read, Invoice) { |i| ... }` cannot be turned into SQL, so `accessible_by` fails. The adapter raises `MissingScopeError` instead of guessing. To accept the cost, declare it on the type: `authorize :read, scope: :in_memory`. Lists are then filtered with `can?` one by one and efficient pagination is lost; `find_by:` and `loads:` find the record and then ask `can?`. Fields covered by the type's rule are not asked about their attribute: give the ones an attribute rule must hide their own `authorize: :action`. Options the adapter does not understand (`policy:`, another `scope:`) raise `ConfigurationError`.
+
+**The audit covers less.** It still reports missing rules, bypasses and unscoped `loads:`, but not whether the `Ability` grants the action: abilities depend on the user.
+
+**Guests.** `Ability.new(nil)` is your ability class's decision. Make it deny everything if there is no user.
+
+## Visibility
+
+Hide a type or a field from users who may not use it, in introspection and in "did you mean" suggestions:
+
+```ruby
+class InvoiceExportType < BaseObject
+  authorize :read, model: Invoice, visible_when: :export     # InvoicePolicy#export? / can?(:export, Invoice)
+end
+
+field :internal_notes, String, authorize: :manage, visible_when: :export
+```
+
+`visible_when:` is an action like any other, but it is asked **of the model's class, with no record**: `InvoicePolicy.new(user, Invoice).export?` with Pundit, `can?(:export, Invoice)` with CanCanCan. Write a method that decides from the user (`user.admin?`), not from the record. Nothing is hidden unless you declare it, and the audit reports a `visible_when:` action the policy does not define.
+
+A hidden member also hides what leads only to it: a root field that returns a hidden type disappears with it.
+
+**Schema dumps.** graphql 2.6 builds an ordinary context for `to_definition`, which cannot be told apart from an anonymous request, and an anonymous request must never see hidden members. Ask for the full schema explicitly:
+
+```ruby
+AppSchema.to_definition(context: { armory_full_schema: true })
+```
+
+Things to know:
+
+- **Hiding is not authorization.** A hidden field is absent from the schema, so a query for it fails like a field that never existed. What the user may *read* is still decided by `authorize`.
+- **The policy receives the class.** A policy that reads the record (`record.account_id`) raises `NoMethodError` for a `visible_when:` action; write that action from the user. The error propagates out of `execute`, so make sure your error handler does not echo it.
+- **CanCanCan conditions are not applied to a class.** `can :export, Invoice, account_id: 1` makes the member visible to anyone who holds the rule. For a field, the attribute is passed: `can?(:export, Invoice, :internal_notes)`.
+- **A subclass that redeclares `authorize` replaces the rule**, `visible_when:` included: repeat it.
+- **`visible_when:` on a field needs a type that includes `Base`** (not an interface or a plain type); otherwise it raises `ConfigurationError` when a query selects it.
+- **Static `Schema::Visibility` profiles are not supported** and raise `ConfigurationError`; plain `use Schema::Visibility`, `dynamic: true` and the default warden work.
+
+Visibility is computed per query (and memoized inside it). Role-based profile caching across requests is graphql-ruby's `Schema::Visibility` feature and is not wrapped here.
+
+## Arguments
+
+An argument with no rule is **covered by its field**: the field already decides whether the user may call it. Declare a rule on the arguments that must be stricter, and they are checked when the client sends them:
+
+```ruby
+class BaseArgument < GraphQL::Schema::Argument
+  include GraphQL::Armory::Authorization::Base
+end
+# in your base field: argument_class BaseArgument
+
+field :invoices, [InvoiceType], authorize: :none, reason: "narrowed by the scope" do
+  argument :include_internal, Boolean, required: false, authorize: :manage, model: Invoice
+  argument :tag, String, required: false, visible_when: :export, model: Invoice
+  argument :status, String, required: false, authorize: :none, reason: "public filter"
+end
+```
+
+- **`authorize: :manage`** asks the policy about the parent object when it is an instance of the model, otherwise about the model's class (a root field has no record, so write the action from the user). The model is the one the field's type wraps, or `model:` when it wraps none, as on a root field. A denial denies the whole field, with the usual null or error.
+- **Defaults.** graphql-ruby does not check an argument the client left at its default, and the two engines disagree about it (the interpreter skips the check, `Execution::Next` applies the default), so a restricted argument with a `default_value:` is refused with an `ArgumentError`. Sending `false` explicitly counts as using the argument.
+- **Every argument class needs `Base`.** `argument_class` is not inherited: set it on your base field, and also on resolvers, input objects (for restricted arguments nested in a filter) and directives that need it.
+- **`visible_when:`** hides the argument like it hides a field: it is absent from introspection and from suggestions, and a query that uses it fails like an argument that never existed.
+- **`authorize: :none, reason:`** only declares and documents: the audit lists it with its reason.
+- `authorize: true` is refused on an argument, and an argument with no model to ask about raises `ConfigurationError`.
+
+## Mutations and resolvers
+
+Include `Base` in your base mutation (or resolver) and declare what each one needs. A mutation is an action, not a read, so `default_action` does not apply and **a mutation with no `authorize` is denied**.
+
+```ruby
+class Mutations::BaseMutation < GraphQL::Schema::RelayClassicMutation
+  include GraphQL::Armory::Authorization::Base
+  argument_class Types::BaseArgument
+  field_class Types::BaseField
+  object_class Types::BaseObject
+end
+
+class Mutations::ApproveInvoice < Mutations::BaseMutation
+  authorize :approve, model: Invoice            # InvoicePolicy#approve?(invoice) / can?(:approve, invoice)
+  argument :invoice_id, ID, loads: Types::Invoice
+  field :invoice, Types::Invoice, null: true
+end
+```
+
+- **The record is the loaded one.** The rule runs after `loads:`, once per loaded record of the model (with none loaded, the model's class is asked). `loads:` goes through the user's scope, so a foreign id answers like a missing one.
+- **Denial** follows the schema's `on_unauthorized` mode, like a field (`null`, `"Not found"`, or raise). With `on_denied: :errors` the mutation does not run and answers `{ errors: [{ message: "Not allowed", code: "FORBIDDEN" }] }` as data, so the payload needs an `errors` field.
+- **Payload types** are ordinary objects: declare `authorize :none, reason: "...", covers_fields: true` so their fields are covered by the mutation instead of denied.
+- **`authorize :none, reason:`** documents a mutation anyone may call; the audit lists it with its reason. A mutation with no rule appears as `:no_rule` (for example `Mutation.forgotten`), and a rule the policy does not define as `:adapter`.
+- An unknown `on_denied:` raises `ArgumentError`; a mutation with a rule but no model raises `ConfigurationError`.
+- **Class-level answers are weak.** With no loaded record of the model (no `loads:`, an empty `loads: [ID]`, or a `loads:` of another type) the rule is asked about the model's class: CanCan answers true for anyone holding the right, and a Pundit policy that reads `record` attributes raises. Load the record you are authorizing.
+- **`ready?` runs before authorization** (and, on the interpreter, before a failing `loads:`). Keep it free of side effects.
+- **`loads:` works on top-level arguments only.** Inside an input object it is not scoped, and the engines disagree (the interpreter raises, `Execution::Next` yields nil).
+- **Do not put `authorize:` on a mutation field or on payload fields**; the mutation's own rule is the one that counts. A subclass that redeclares `authorize :none` is open to everyone, on purpose.
+
+## Interfaces and unions
+
+They are never authorized themselves: graphql-ruby only runs `authorized?` on the concrete type, and every path ends there (root field, association, each list item, `loads:`, union and interface resolution). A foreign object in a list of a union or an interface comes back `null`, like in any other list. So `include Base` in an interface or a union is refused with a message pointing to the possible types; declare the rule on each concrete type.
+
+What an interface adds is its fields, declared once and resolved on many types:
+
+- A field with no rule is **covered** by the rule of the Base types that implement the interface (a plain implementer runs no check at all), unless one of them is a bypass (`authorize :none`). Then the field is **denied for every implementer**, because it cannot tell which type it runs on, and the audit reports it (`:field_without_rule`, for example `Document.number`). Declare it (`authorize: :none, reason:` or an action) to fix it.
+- `visible_when:` is not supported on an interface field; put it on the concrete types' fields.
+- `authorize: true` is not valid on an interface field: it is always denied, and the audit does not flag it. Use an action or `:none`.
+- An interface whose field class does not include `Base`, such as graphql-ruby's built-in Relay `Node`, runs no field check, so its `id` stays readable on a bypassed implementer. Give your own `Node` interface a Base field class if that matters.
+
+## Telemetry
+
+Pass `sinks: [->(signal, data) {}]`. Signals are `:allowed`, `:denied`, `:bypassed`; data holds only `type`, `action` and `reason`, never record attributes.
+
+## Guarantees and limits
+
+Covered by the black-box suite in `spec/security`, on both engines: user A cannot read user B's objects by root field, nested association or `loads:`; lists never contain foreign objects; uncovered types fail closed and show in the audit; a field hidden with `visible?` is absent from introspection and error suggestions (that is graphql-ruby's behaviour, pinned by a test).
+
+Not covered yet: decoding global IDs in `loads:`. Policies must return `true`/`false`/`nil`; anything else raises `AdapterError`. Do not use `dataloader.request` inside policies; use `dataloader.with(...).load`.
+
+## Engines
+
+Both execution engines are tested: the default interpreter and `Execution::Next`. In graphql 2.5.26 to 2.6.1, Next crashes on denied fields, so the gem refuses to run on Next there (`ConfigurationError`). Everything else works from graphql 2.4.
+
+## Performance
+
+`benchmark/authorization.rb`, 1000 invoices, graphql 2.6.2, Ruby 3.2, Docker on Windows:
+
+| Engine | Query | plain | armory (array) | armory (relation) |
+|---|---|---|---|---|
+| interpreter | `number` | 117.6 i/s | 45.9 i/s | 44.2 i/s |
+| interpreter | 3 fields | 58.8 i/s | 21.6 i/s | 21.0 i/s |
+| next | `number` | 654.2 i/s | 71.8 i/s | 70.8 i/s |
+| next | 3 fields | 417.5 i/s | 42.1 i/s | 39.5 i/s |
+
+The absolute cost is about 13 to 15 ms per 1000 items on both engines; most of it is probably Pundit's policy lookup, which is not cached so code reloading cannot serve stale classes. Run it yourself: `docker compose run --rm test bundle exec ruby benchmark/authorization.rb` (add `GRAPHQL_ARMORY_ENGINE=next` for Next).
+
+## Migrating
+
+Coming from hand-written `authorized?` and `scope_items`? See [MIGRATING.md](MIGRATING.md).
+
+## Development
+
+Ruby is not required on the host:
+
+```
+docker compose run --rm test                                    # full suite, interpreter
+GRAPHQL_ARMORY_ENGINE=next docker compose run --rm test         # full suite, Execution::Next
+GRAPHQL_VERSION="~> 2.4.0" docker compose run --rm test         # another graphql version
+```
+
+## Roadmap
+
+Status: ✅ done, 🚧 in progress, ⬜ not started. Update this table in the same PR that changes a module.
+
+| Order | Module | Status | Current limits |
+|---|---|---|---|
+| 1 | Authorization (Pundit, CanCanCan) | 🚧 | Pundit and CanCanCan done (the audit checks less with CanCanCan). Not covered yet: decoding global IDs in `loads:`. `Execution::Next` needs graphql >= 2.6.2. Unreleased. |
+| 2 | Encrypted, versioned IDs and cursors | ⬜ | Research not started. |
+| 3 | Persisted queries / operation whitelisting | ⬜ | Research not started. |
+| 4 | Rate limiting | ⬜ | Research not started. |
+| 5 | Stable (keyset) connections | ⬜ | Research not started. |
+| 6 | Subscriptions over Pusher / Ably | ⬜ | Research not started. |
+| 7 | Response caching | ⬜ | Research not started. |
+| 8 | API versioning (changesets) | ⬜ | Research not started. |
+| 9 | `@defer` / `@stream` | ⬜ | Research not started. |
+| 10 | Dashboard | ⬜ | Research not started. |
+
+Each module starts with its own research before design. A module is ✅ only when it is released and its limits are documented here.
+
+## Related gems
+
+- [graphql-armory-rust_parser](https://github.com/israelb/graphql-armory-rust_parser): a GraphQL parser written in Rust, installable as graphql-ruby's default parser.
+
+## Clean-room policy
+
+This project is written independently. It uses only graphql-ruby's open-source code, its public guides, and the public documentation of Pundit and CanCanCan. It does not use, copy or derive from GraphQL-Pro or GraphQL-Enterprise code.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

data/lib/graphql/armory/authorization/adapters/cancan.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "cancancan"
+
+module GraphQL
+  module Armory
+    module Authorization
+      module Adapters
+        # Answers the core's four questions with CanCanCan's public API.
+        #
+        # The actor is an Ability: `context[:current_ability]`, else `Ability.new(context[:current_user])`
+        # (or the class given as `ability_class:`). It is built once per query.
+        #
+        # A field that declares its own action (`authorize: :manage`) passes its attribute to `can?`: with
+        # `can :read, User, [:username]`, `can?(:read, user)`
+        # is true even though only one attribute is readable. Fields covered by their type's rule are not asked
+        # about their attribute: declare an action on the ones an attribute rule must hide.
+        class CanCan
+          def initialize(ability_class: nil)
+            @ability_class = ability_class
+          end
+
+          def actor(context)
+            context[:current_ability] || ability_for(context)
+          end
+
+          def authorized?(ability, subject, rule)
+            options!(rule)
+            return ability.can?(rule.action, subject, rule.attribute) if rule.attribute
+
+            ability.can?(rule.action, subject)
+          end
+
+          # A relation is narrowed in SQL with `accessible_by`, so it stays paginable. A rule defined only
+          # with a block cannot be turned into SQL: it fails, unless the type declared `scope: :in_memory`,
+          # which filters with `can?` and gives up efficient pagination.
+          def scope(ability, items, rule)
+            options!(rule)
+            return in_memory(ability, items, rule) if items.is_a?(Array) || rule.scope == :in_memory
+
+            accessible(ability, items, rule)
+          end
+
+          # Abilities depend on the user, so only what the declaration itself gets wrong can be reported.
+          def check(_type, rule)
+            return [] if rule.none?
+
+            problems(rule)
+          end
+
+          private
+
+          # What this adapter does not understand is refused, never ignored.
+          def problems(rule)
+            found = []
+            found << "policy: is a Pundit option; CanCanCan has no policy classes" if rule.policy
+            found << "scope: #{rule.scope.inspect} is not supported; use :in_memory" unless [nil, :in_memory].include?(rule.scope)
+            found
+          end
+
+          def options!(rule)
+            found = problems(rule)
+            raise ConfigurationError, found.join("; ") unless found.empty?
+          end
+
+          def accessible(ability, items, rule)
+            items.accessible_by(ability, rule.action)
+          rescue ::CanCan::Error
+            raise MissingScopeError,
+                  "a rule defined with a block cannot be turned into SQL: add an SQL or scope argument " \
+                  "to the rule, or declare `scope: :in_memory` on the type"
+          end
+
+          def in_memory(ability, items, rule)
+            items.select { |item| authorized?(ability, item, rule) == true }
+          end
+
+          def ability_for(context)
+            store = context.namespace(:armory)
+            store[:cancan_ability] ||= ability_class.new(context[:current_user])
+          end
+
+          def ability_class
+            @ability_class || (Object.const_get(:Ability) if Object.const_defined?(:Ability)) ||
+              raise(ConfigurationError, "no Ability class found: define ::Ability, pass `ability_class:` " \
+                                        "to the adapter or put an ability in context[:current_ability]")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/armory/authorization/adapters/null.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module GraphQL
+  module Armory
+    module Authorization
+      module Adapters
+        # The adapter of an object nobody configured: it denies everything.
+        class Null
+          def actor(_context)
+            nil
+          end
+
+          def authorized?(_actor, _subject, _rule)
+            false
+          end
+
+          def scope(_actor, items, _rule)
+            items.respond_to?(:none) ? items.none : []
+          end
+
+          def check(_type, _rule)
+            ["no adapter is configured: everything is denied"]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/graphql/armory/authorization/adapters/pundit.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "pundit"
+
+module GraphQL
+  module Armory
+    module Authorization
+      module Adapters
+        # Answers the core's four questions with Pundit's public API.
+        #
+        # The policy is found from the model through Pundit::PolicyFinder, so `policy_class`
+        # overrides and namespaced models work. A policy must answer `true`, `false` or `nil`:
+        # anything else (a lazy, a record) is handed back as is and the core refuses it.
+        class Pundit
+          def actor(context)
+            context[:current_user]
+          end
+
+          def authorized?(user, subject, rule)
+            policy = policy_class(rule, subject).new(user, subject)
+            query = query_for(rule)
+            unless policy.respond_to?(query)
+              raise AdapterError, "#{policy.class} does not define #{query}"
+            end
+
+            policy.public_send(query)
+          end
+
+          def scope(user, items, rule)
+            return items.select { |item| authorized?(user, item, rule) == true } if items.is_a?(Array)
+
+            policy = policy_class(rule, rule.model || items)
+            scope_class = scope_constant(policy)
+            raise MissingScopeError, "#{policy} has no Scope class" if scope_class.nil?
+
+            scope_class.new(user, items).resolve
+          end
+
+          def check(type, rule)
+            return [] if rule.none?
+
+            model = normalize(rule.model || type)
+            policy = rule.policy || finder(model).policy
+            return ["#{model.is_a?(Symbol) ? model.to_s.camelize : model}Policy not found"] if policy.nil?
+
+            problems = []
+            query = query_for(rule)
+            problems << "#{policy}##{query} is not defined" unless policy.public_method_defined?(query)
+            problems << "#{policy}::Scope is not defined" if scope_constant(policy).nil?
+            problems
+          end
+
+          private
+
+          def policy_class(rule, subject)
+            rule.policy || finder(subject).policy!
+          end
+
+          def query_for(rule)
+            :"#{rule.action}?"
+          end
+
+          def finder(subject)
+            ::Pundit::PolicyFinder.new(normalize(subject))
+          end
+
+          # Pundit reads a Symbol as a model name but a String as a plain object.
+          def normalize(subject)
+            subject.is_a?(String) ? subject.to_sym : subject
+          end
+
+          # Looks the Scope up through the policy's ancestors but never in Object, so a
+          # top-level constant called Scope cannot be mistaken for a policy scope.
+          def scope_constant(policy)
+            owner = policy.ancestors.take_while { |ancestor| ancestor != Object }
+                          .find { |ancestor| ancestor.const_defined?(:Scope, false) }
+            owner&.const_get(:Scope, false)
+          end
+        end
+      end
+    end
+  end
+end