graphql_devise 0.11.0 → 0.12.0

data/lib/graphql_devise/resource_loader.rb

@@ -0,0 +1,87 @@
+module GraphqlDevise
+  class ResourceLoader
+    def initialize(resource, options = {}, routing = false)
+      @resource           = resource
+      @options            = options
+      @routing            = routing
+      @default_operations = GraphqlDevise::DefaultOperations::MUTATIONS.merge(GraphqlDevise::DefaultOperations::QUERIES)
+    end
+
+    def call(query, mutation)
+      mapping_name = @resource.to_s.underscore.tr('/', '_').to_sym
+
+      # clean_options responds to all keys defined in GraphqlDevise::MountMethod::SUPPORTED_OPTIONS
+      clean_options = GraphqlDevise::MountMethod::OptionSanitizer.new(@options).call!
+
+      return clean_options if GraphqlDevise.resource_mounted?(mapping_name) && @routing
+
+      validate_options!(clean_options)
+
+      authenticatable_type = clean_options.authenticatable_type.presence ||
+                             "Types::#{@resource}Type".safe_constantize ||
+                             GraphqlDevise::Types::AuthenticatableType
+
+      prepared_mutations = prepare_mutations(mapping_name, clean_options, authenticatable_type)
+
+      if prepared_mutations.any? && mutation.blank?
+        raise GraphqlDevise::Error, 'You need to provide a mutation type unless all mutations are skipped'
+      end
+
+      prepared_mutations.each do |action, prepared_mutation|
+        mutation.field(action, mutation: prepared_mutation, authenticate: false)
+      end
+
+      prepared_resolvers = prepare_resolvers(mapping_name, clean_options, authenticatable_type)
+
+      if prepared_resolvers.any? && query.blank?
+        raise GraphqlDevise::Error, 'You need to provide a query type unless all queries are skipped'
+      end
+
+      prepared_resolvers.each do |action, resolver|
+        query.field(action, resolver: resolver, authenticate: false)
+      end
+
+      GraphqlDevise.add_mapping(mapping_name, @resource)
+      GraphqlDevise.mount_resource(mapping_name) if @routing
+
+      clean_options
+    end
+
+    private
+
+    def prepare_resolvers(mapping_name, clean_options, authenticatable_type)
+      GraphqlDevise::MountMethod::OperationPreparer.new(
+        mapping_name:          mapping_name,
+        custom:                clean_options.operations,
+        additional_operations: clean_options.additional_queries,
+        preparer:              GraphqlDevise::MountMethod::OperationPreparers::ResolverTypeSetter.new(authenticatable_type),
+        selected_operations:   GraphqlDevise::MountMethod::OperationSanitizer.call(
+          default: GraphqlDevise::DefaultOperations::QUERIES, only: clean_options.only, skipped: clean_options.skip
+        )
+      ).call
+    end
+
+    def prepare_mutations(mapping_name, clean_options, authenticatable_type)
+      GraphqlDevise::MountMethod::OperationPreparer.new(
+        mapping_name:          mapping_name,
+        custom:                clean_options.operations,
+        additional_operations: clean_options.additional_mutations,
+        preparer:              GraphqlDevise::MountMethod::OperationPreparers::MutationFieldSetter.new(authenticatable_type),
+        selected_operations:   GraphqlDevise::MountMethod::OperationSanitizer.call(
+          default: GraphqlDevise::DefaultOperations::MUTATIONS, only: clean_options.only, skipped: clean_options.skip
+        )
+      ).call
+    end
+
+    def validate_options!(clean_options)
+      GraphqlDevise::MountMethod::OptionsValidator.new(
+        [
+          GraphqlDevise::MountMethod::OptionValidators::SkipOnlyValidator.new(options: clean_options),
+          GraphqlDevise::MountMethod::OptionValidators::ProvidedOperationsValidator.new(
+            options: clean_options, supported_operations: @default_operations
+          )
+        ]
+      ).validate!
+    end
+  end
+end

data/{app/graphql → lib}/graphql_devise/schema.rb

@@ -1,5 +1,4 @@
 module GraphqlDevise
   class Schema < GraphQL::Schema
-    query(GraphqlDevise::Types::QueryType)
   end
 end

data/lib/graphql_devise/schema_plugin.rb

@@ -0,0 +1,87 @@
+module GraphqlDevise
+  class SchemaPlugin
+    DEFAULT_NOT_AUTHENTICATED = ->(field) { raise GraphqlDevise::UserError, "#{field} field requires authentication" }
+
+    def initialize(query: nil, mutation: nil, authenticate_default: true, resource_loaders: [], unauthenticated_proc: DEFAULT_NOT_AUTHENTICATED)
+      @query                = query
+      @mutation             = mutation
+      @resource_loaders     = resource_loaders
+      @authenticate_default = authenticate_default
+      @unauthenticated_proc = unauthenticated_proc
+
+      # Must happen on initialize so operations are loaded before the types are added to the schema on GQL < 1.10
+      load_fields
+    end
+
+    def use(schema_definition)
+      schema_definition.tracer(self)
+    end
+
+    def trace(event, trace_data)
+      # Authenticate only root level queries
+      return yield unless event == 'execute_field' && path(trace_data).count == 1
+
+      field = traced_field(trace_data)
+      provided_value = authenticate_option(field, trace_data)
+
+      if !provided_value.nil?
+        raise_on_missing_resource(context(trace_data), field) if provided_value
+      elsif @authenticate_default
+        raise_on_missing_resource(context(trace_data), field)
+      end
+
+      yield
+    end
+
+    private
+
+    def raise_on_missing_resource(context, field)
+      @unauthenticated_proc.call(field.name) if context[:current_resource].blank?
+    end
+
+    def context(trace_data)
+      query = if trace_data[:context]
+        trace_data[:context].query
+      else
+        trace_data[:query]
+      end
+
+      query.context
+    end
+
+    def path(trace_data)
+      if trace_data[:context]
+        trace_data[:context].path
+      else
+        trace_data[:path]
+      end
+    end
+
+    def traced_field(trace_data)
+      if trace_data[:context]
+        trace_data[:context].field
+      else
+        trace_data[:field]
+      end
+    end
+
+    def authenticate_option(field, trace_data)
+      if trace_data[:context]
+        field.metadata[:authenticate]
+      else
+        field.graphql_definition.metadata[:authenticate]
+      end
+    end
+
+    def load_fields
+      @resource_loaders.each do |resource_loader|
+        raise Error, 'Invalid resource loader instance' unless resource_loader.instance_of?(GraphqlDevise::ResourceLoader)
+
+        resource_loader.call(@query, @mutation)
+      end
+    end
+  end
+end
+
+GraphQL::Field.accepts_definitions(authenticate: GraphQL::Define.assign_metadata_key(:authenticate))
+GraphQL::Schema::Field.accepts_definition(:authenticate)

data/lib/graphql_devise/version.rb

@@ -1,3 +1,3 @@
 module GraphqlDevise
-  VERSION = '0.11.0'.freeze
+  VERSION = '0.12.0'.freeze
 end

data/spec/dummy/app/controllers/api/v1/graphql_controller.rb

@@ -3,10 +3,19 @@ module Api
     class GraphqlController < ApplicationController
       include GraphqlDevise::Concerns::SetUserByToken
 
-      before_action :authenticate_user!
+      before_action -> { set_resource_by_token(:user) }
 
       def graphql
-        render json: DummySchema.execute(params[:query])
+        render json: DummySchema.execute(params[:query], context: graphql_context)
+      end
+
+      def interpreter
+        render json: InterpreterSchema.execute(params[:query], context: graphql_context)
+      end
+
+      private
+
+      def verify_authenticity_token
       end
     end
   end

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,2 +1,3 @@
 class ApplicationController < ActionController::Base
+  protect_from_forgery with: :exception
 end

data/spec/dummy/app/graphql/dummy_schema.rb

@@ -1,4 +1,13 @@
 class DummySchema < GraphQL::Schema
+  use GraphqlDevise::SchemaPlugin.new(
+    query:            Types::QueryType,
+    mutation:         Types::MutationType,
+    resource_loaders: [
+      GraphqlDevise::ResourceLoader.new('User', only: [:login, :confirm_account]),
+      GraphqlDevise::ResourceLoader.new('Guest', only: [:logout])
+    ]
+  )
+
   mutation(Types::MutationType)
   query(Types::QueryType)
 end

data/spec/dummy/app/graphql/interpreter_schema.rb

@@ -0,0 +1,9 @@
+class InterpreterSchema < GraphQL::Schema
+  use GraphQL::Execution::Interpreter if Gem::Version.new(GraphQL::VERSION) >= Gem::Version.new('1.9.0')
+  use GraphQL::Analysis::AST          if Gem::Version.new(GraphQL::VERSION) >= Gem::Version.new('1.10.0')
+
+  use GraphqlDevise::SchemaPlugin.new(query: Types::QueryType, authenticate_default: false)
+
+  mutation(Types::MutationType)
+  query(Types::QueryType)
+end

data/spec/dummy/app/graphql/types/mutation_type.rb

@@ -1,6 +1,6 @@
 module Types
   class MutationType < Types::BaseObject
-    field :dummy_mutation, String, null: false
+    field :dummy_mutation, String, null: false, authenticate: true
 
     def dummy_mutation
       'Necessary so GraphQL gem does not complain about empty mutation type'

data/spec/dummy/app/graphql/types/query_type.rb

@@ -1,5 +1,15 @@
 module Types
   class QueryType < Types::BaseObject
     field :user, resolver: Resolvers::UserShow
+    field :public_field, String, null: false, authenticate: false
+    field :private_field, String, null: false, authenticate: true
+
+    def public_field
+      'Field does not require authentication'
+    end
+
+    def private_field
+      'Field will always require authentication'
+    end
   end
 end

data/spec/dummy/config/environments/test.rb

@@ -10,7 +10,7 @@ Rails.application.configure do
   # Do not eager load code on boot. This avoids loading your whole application
   # just for the purpose of running a single test. If you are using a tool that
   # preloads Rails for running tests, you may have to set it to true.
-  config.eager_load = false
+  config.eager_load = ENV['EAGER_LOAD'].present?
 
   # Configure public file server for tests with Cache-Control for performance.
   if Rails::VERSION::MAJOR >= 5

data/spec/dummy/config/routes.rb

@@ -28,4 +28,5 @@ Rails.application.routes.draw do
   )
 
   post '/api/v1/graphql', to: 'api/v1/graphql#graphql'
+  post '/api/v1/interpreter', to: 'api/v1/graphql#interpreter'
 end

data/spec/generators/graphql_devise/install_generator_spec.rb

@@ -3,50 +3,82 @@ require 'rails_helper'
 require 'generators/graphql_devise/install_generator'
 
 RSpec.describe GraphqlDevise::InstallGenerator, type: :generator do
-  destination File.expand_path('../../../tmp', __FILE__)
+  destination File.expand_path('../../../../gqld_dummy', __dir__)
+
+  let(:routes_path)    { "#{destination_root}/config/routes.rb" }
+  let(:routes_content) { File.read(routes_path) }
+  let(:dta_route)      { 'mount_devise_token_auth_for' }
+
+  after(:all) { FileUtils.rm_rf(destination_root) }
 
   before do
     prepare_destination
+    create_rails_project
+    run_generator(args)
   end
 
-  let(:routes_path)    { "#{destination_root}/config/routes.rb" }
-  let(:routes_content) { File.read(routes_path) }
-  let(:dta_route)      { "mount_devise_token_auth_for 'User', at: 'auth'" }
-
-  xcontext 'when the file exists' do
-    before do
-      create_file_with_content(
-        routes_path,
-        "Rails.application.routes.draw do\n#{dta_route}\nend"
-      )
-    end
+  context 'when mount option is schema' do
+    let(:args) { ['Admin', '--mount', 'GqldDummySchema'] }
+
+    it 'mounts the SchemaPlugin' do
+      assert_file 'config/initializers/devise.rb'
+      assert_file 'config/initializers/devise_token_auth.rb', /^\s{2}#{Regexp.escape('config.change_headers_on_each_request = false')}/
+      assert_file 'config/locales/devise.en.yml'
+
+      assert_migration 'db/migrate/devise_token_auth_create_admins.rb'
 
-    context 'when passing no params to the generator' do
-      before { run_generator }
+      assert_file 'app/models/admin.rb', /^\s{2}devise :.+include GraphqlDevise::Concerns::Model/m
 
-      it 'replaces dta route using the default values for class and path' do
-        generator_added_route = /  mount_graphql_devise_for 'User', at: 'auth'/
-        expect(routes_content).to match(generator_added_route)
-        expect(routes_content).not_to match(dta_route)
-      end
+      assert_file 'app/controllers/application_controller.rb', /^\s{2}include GraphqlDevise::Concerns::SetUserByToken/
+
+      assert_file 'app/graphql/gqld_dummy_schema.rb', /\s+#{Regexp.escape("GraphqlDevise::ResourceLoader.new('Admin')")}/
     end
+  end
+
+  context 'when passing no params to the generator' do
+    let(:args) { [] }
 
-    context 'when passing custom params to the generator' do
-      before { run_generator %w[Admin api] }
+    it 'creates and updated required files' do
+      assert_file 'config/routes.rb', /^\s{2}mount_graphql_devise_for 'User', at: 'auth'/
+      expect(routes_content).not_to match(dta_route)
 
-      it 'add the routes using the provided values for class and path and keeps dta route' do
-        generator_added_route = /  mount_graphql_devise_for 'Admin', at: 'api'/
-        expect(routes_content).to match(generator_added_route)
-        expect(routes_content).to match(dta_route)
-      end
+      assert_file 'config/initializers/devise.rb'
+      assert_file 'config/initializers/devise_token_auth.rb', /^\s{2}#{Regexp.escape('config.change_headers_on_each_request = false')}/
+      assert_file 'config/locales/devise.en.yml'
+
+      assert_migration 'db/migrate/devise_token_auth_create_users.rb'
+
+      assert_file 'app/models/user.rb', /^\s{2}devise :.+include GraphqlDevise::Concerns::Model/m
+
+      assert_file 'app/controllers/application_controller.rb', /^\s{2}include GraphqlDevise::Concerns::SetUserByToken/
     end
   end
 
-  xcontext 'when file does *NOT* exist' do
-    before { run_generator }
+  context 'when passing custom params to the generator' do
+    let(:args) { %w[Admin api] }
+
+    it 'creates and updated required files' do
+      assert_file 'config/routes.rb', /^\s{2}mount_graphql_devise_for 'Admin', at: 'api'/
+      expect(routes_content).not_to match(dta_route)
+
+      assert_file 'config/initializers/devise.rb'
+      assert_file 'config/initializers/devise_token_auth.rb', /^\s{2}#{Regexp.escape('config.change_headers_on_each_request = false')}/
+      assert_file 'config/locales/devise.en.yml'
+
+      assert_migration 'db/migrate/devise_token_auth_create_admins.rb'
 
-    it 'does *NOT* create the file and throw no exception' do
-      expect(File.exist?(routes_path)).to be_falsey
+      assert_file 'app/models/admin.rb', /^\s{2}devise :.+include GraphqlDevise::Concerns::Model/m
+
+      assert_file 'app/controllers/application_controller.rb', /^\s{2}include GraphqlDevise::Concerns::SetUserByToken/
+    end
+  end
+
+  def create_rails_project
+    FileUtils.cd(File.join(destination_root, '..')) do
+      `rails new gqld_dummy -S -C --skip-action-mailbox --skip-action-text -T --skip-spring --skip-bundle --skip-keeps -G --skip-active-storage -J --skip-listen --skip-bootsnap`
+    end
+    FileUtils.cd(File.join(destination_root, '../gqld_dummy')) do
+      `rails generate graphql:install`
     end
   end
 end

data/spec/rails_helper.rb

@@ -38,5 +38,8 @@ RSpec.configure do |config|
   config.include(Requests::JsonHelpers, type: :request)
   config.include(Requests::AuthHelpers, type: :request)
   config.include(ActiveSupport::Testing::TimeHelpers)
-  config.include(Generators::FileHelpers, type: :generator)
+
+  config.before(:suite) do
+    ActionController::Base.allow_forgery_protection = true
+  end
 end

data/spec/requests/graphql_controller_spec.rb

@@ -0,0 +1,80 @@
+require 'rails_helper'
+
+RSpec.describe GraphqlDevise::GraphqlController do
+  let(:password) { 'password123' }
+  let(:user)     { create(:user, :confirmed, password: password) }
+  let(:params)   { { query: query, variables: variables } }
+  let(:request_params) do
+    if Rails::VERSION::MAJOR >= 5
+      { params: params }
+    else
+      params
+    end
+  end
+
+  context 'when variables are a string' do
+    let(:variables) { "{\"email\": \"#{user.email}\"}" }
+    let(:query)     { "mutation($email: String!) { userLogin(email: $email, password: \"#{password}\") { user { email name signInCount } } }" }
+
+    it 'parses the string variables' do
+      post '/api/v1/graphql_auth', request_params
+
+      expect(json_response).to match(
+        data: { userLogin: { user: { email: user.email, name: user.name, signInCount: 1 } } }
+      )
+    end
+
+    context 'when variables is an empty string' do
+      let(:variables) { '' }
+      let(:query)     { "mutation { userLogin(email: \"#{user.email}\", password: \"#{password}\") { user { email name signInCount } } }" }
+
+      it 'returns an empty hash as variables' do
+        post '/api/v1/graphql_auth', request_params
+
+        expect(json_response).to match(
+          data: { userLogin: { user: { email: user.email, name: user.name, signInCount: 1 } } }
+        )
+      end
+    end
+  end
+
+  context 'when variables are not a string or hash' do
+    let(:variables) { 1 }
+    let(:query)     { "mutation($email: String!) { userLogin(email: $email, password: \"#{password}\") { user { email name signInCount } } }" }
+
+    it 'raises an error' do
+      expect do
+        post '/api/v1/graphql_auth', request_params
+      end.to raise_error(ArgumentError)
+    end
+  end
+
+  context 'when multiplexing queries' do
+    let(:params) do
+      {
+        _json: [
+          { query: "mutation { userLogin(email: \"#{user.email}\", password: \"#{password}\") { user { email name signInCount } } }" },
+          { query: "mutation { userLogin(email: \"#{user.email}\", password: \"wrong password\") { user { email name signInCount } } }" }
+        ]
+      }
+    end
+
+    it 'executes multiple queries in the same request' do
+      post '/api/v1/graphql_auth', request_params
+
+      expect(json_response).to match(
+        [
+          { data: { userLogin: { user: { email: user.email, name: user.name, signInCount: 1 } } } },
+          {
+            data:   { userLogin: nil },
+            errors: [
+              hash_including(
+                message: 'Invalid login credentials. Please try again.', extensions: { code: 'USER_ERROR' }
+              )
+            ]
+          }
+        ]
+      )
+    end
+  end
+end