graphql_devise 0.11.4 → 0.13.0

data/lib/graphql_devise/schema.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   class Schema < GraphQL::Schema
   end

data/lib/graphql_devise/schema_plugin.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+module GraphqlDevise
+  class SchemaPlugin
+    DEFAULT_NOT_AUTHENTICATED = ->(field) { raise GraphqlDevise::AuthenticationError, "#{field} field requires authentication" }
+
+    def initialize(query: nil, mutation: nil, authenticate_default: true, resource_loaders: [], unauthenticated_proc: DEFAULT_NOT_AUTHENTICATED)
+      @query                = query
+      @mutation             = mutation
+      @resource_loaders     = resource_loaders
+      @authenticate_default = authenticate_default
+      @unauthenticated_proc = unauthenticated_proc
+
+      # Must happen on initialize so operations are loaded before the types are added to the schema on GQL < 1.10
+      load_fields
+      reconfigure_warden!
+    end
+
+    def use(schema_definition)
+      schema_definition.tracer(self)
+    end
+
+    def trace(event, trace_data)
+      # Authenticate only root level queries
+      return yield unless event == 'execute_field' && path(trace_data).count == 1
+
+      field = traced_field(trace_data)
+      provided_value = authenticate_option(field, trace_data)
+      context = set_current_resource(context_from_data(trace_data))
+
+      if !provided_value.nil?
+        raise_on_missing_resource(context, field) if provided_value
+      elsif @authenticate_default
+        raise_on_missing_resource(context, field)
+      end
+
+      yield
+    end
+
+    private
+
+    def set_current_resource(context)
+      controller                 = context[:controller]
+      resource_names             = Array(context[:resource_name])
+      context[:current_resource] = resource_names.find do |resource_name|
+        unless Devise.mappings.key?(resource_name)
+          raise(
+            GraphqlDevise::Error,
+            "Invalid resource_name `#{resource_name}` provided to `graphql_context`. Possible values are: #{Devise.mappings.keys}."
+          )
+        end
+
+        found = controller.set_resource_by_token(resource_name)
+        break found if found
+      end
+
+      context
+    end
+
+    def raise_on_missing_resource(context, field)
+      @unauthenticated_proc.call(field.name) if context[:current_resource].blank?
+    end
+
+    def context_from_data(trace_data)
+      query = if trace_data[:context]
+        trace_data[:context].query
+      else
+        trace_data[:query]
+      end
+
+      query.context
+    end
+
+    def path(trace_data)
+      if trace_data[:context]
+        trace_data[:context].path
+      else
+        trace_data[:path]
+      end
+    end
+
+    def traced_field(trace_data)
+      if trace_data[:context]
+        trace_data[:context].field
+      else
+        trace_data[:field]
+      end
+    end
+
+    def authenticate_option(field, trace_data)
+      if trace_data[:context]
+        field.metadata[:authenticate]
+      else
+        field.graphql_definition.metadata[:authenticate]
+      end
+    end
+
+    def reconfigure_warden!
+      Devise.class_variable_set(:@@warden_configured, nil)
+      Devise.configure_warden!
+    end
+
+    def load_fields
+      @resource_loaders.each do |resource_loader|
+        raise Error, 'Invalid resource loader instance' unless resource_loader.instance_of?(GraphqlDevise::ResourceLoader)
+
+        resource_loader.call(@query, @mutation)
+      end
+    end
+  end
+end
+
+GraphQL::Field.accepts_definitions(authenticate: GraphQL::Define.assign_metadata_key(:authenticate))
+GraphQL::Schema::Field.accepts_definition(:authenticate)

data/lib/graphql_devise/types/authenticatable_type.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   module Types
     class AuthenticatableType < GraphQL::Schema::Object

data/lib/graphql_devise/types/credential_type.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   module Types
     class CredentialType < GraphQL::Schema::Object

data/lib/graphql_devise/types/mutation_type.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   module Types
     class MutationType < GraphQL::Schema::Object

data/lib/graphql_devise/types/query_type.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   module Types
     class QueryType < GraphQL::Schema::Object

data/lib/graphql_devise/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
-  VERSION = '0.11.4'.freeze
+  VERSION = '0.13.0'.freeze
 end

data/spec/dummy/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Add your own tasks in files placed in lib/tasks ending in .rake,
 # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
 

data/spec/dummy/app/controllers/api/v1/graphql_controller.rb

@@ -1,16 +1,51 @@
+# frozen_string_literal: true
+
 module Api
   module V1
     class GraphqlController < ApplicationController
       include GraphqlDevise::Concerns::SetUserByToken
 
-      before_action :authenticate_user!
-
       def graphql
-        render json: DummySchema.execute(params[:query])
+        result = DummySchema.execute(params[:query], execute_params(params))
+
+        render json: result unless performed?
+      end
+
+      def interpreter
+        render json: InterpreterSchema.execute(params[:query], execute_params(params))
+      end
+
+      def failing_resource_name
+        render json: DummySchema.execute(params[:query], context: graphql_context([:user, :fail]))
       end
 
       private
 
+      def execute_params(item)
+        {
+          operation_name: item[:operationName],
+          variables:      ensure_hash(item[:variables]),
+          context:        graphql_context([:user, :schema_user])
+        }
+      end
+
+      def ensure_hash(ambiguous_param)
+        case ambiguous_param
+        when String
+          if ambiguous_param.present?
+            ensure_hash(JSON.parse(ambiguous_param))
+          else
+            {}
+          end
+        when Hash, ActionController::Parameters
+          ambiguous_param
+        when nil
+          {}
+        else
+          raise ArgumentError, "Unexpected parameter: #{ambiguous_param}"
+        end
+      end
+
       def verify_authenticity_token
       end
     end

data/spec/dummy/app/controllers/application_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
 end

data/spec/dummy/app/graphql/dummy_schema.rb

@@ -1,4 +1,25 @@
+# frozen_string_literal: true
+
 class DummySchema < GraphQL::Schema
+  use GraphqlDevise::SchemaPlugin.new(
+    query:            Types::QueryType,
+    mutation:         Types::MutationType,
+    resource_loaders: [
+      GraphqlDevise::ResourceLoader.new(
+        'User',
+        only: [
+          :login,
+          :confirm_account,
+          :send_password_reset,
+          :resend_confirmation,
+          :check_password_token
+        ]
+      ),
+      GraphqlDevise::ResourceLoader.new('Guest', only: [:logout]),
+      GraphqlDevise::ResourceLoader.new('SchemaUser')
+    ]
+  )
+
   mutation(Types::MutationType)
   query(Types::QueryType)
 end

data/spec/dummy/app/graphql/interpreter_schema.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class InterpreterSchema < GraphQL::Schema
+  use GraphQL::Execution::Interpreter if Gem::Version.new(GraphQL::VERSION) >= Gem::Version.new('1.9.0')
+  use GraphQL::Analysis::AST          if Gem::Version.new(GraphQL::VERSION) >= Gem::Version.new('1.10.0')
+
+  use GraphqlDevise::SchemaPlugin.new(query: Types::QueryType, authenticate_default: false)
+
+  mutation(Types::MutationType)
+  query(Types::QueryType)
+end

data/spec/dummy/app/graphql/mutations/login.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Mutations
   class Login < GraphqlDevise::Mutations::Login
     field :user, Types::UserType, null: true

data/spec/dummy/app/graphql/mutations/register_confirmed_user.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Mutations
   class RegisterConfirmedUser < GraphqlDevise::Mutations::Base
     argument :email,                 String, required: true

data/spec/dummy/app/graphql/mutations/sign_up.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Mutations
   class SignUp < GraphqlDevise::Mutations::SignUp
     argument :name, String, required: false

data/spec/dummy/app/graphql/mutations/update_user.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Mutations
+  class UpdateUser < GraphQL::Schema::Mutation
+    field :user, Types::UserType, null: false
+
+    argument :email, String, required: false
+    argument :name,  String, required: false
+
+    def resolve(**attrs)
+      user = context[:current_resource]
+
+      schema_url = context[:controller].full_url_without_params
+
+      user.update_with_email(
+        attrs.merge(schema_url: schema_url, confirmation_success_url: 'https://google.com')
+      )
+
+      { user: user }
+    end
+  end
+end

data/spec/dummy/app/graphql/resolvers/public_user.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Resolvers
   class PublicUser < GraphQL::Schema::Resolver
     type Types::UserType, null: false

data/spec/dummy/app/graphql/resolvers/user_show.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Resolvers
   class UserShow < GraphQL::Schema::Resolver
     type Types::UserType, null: false

data/spec/dummy/app/graphql/types/base_object.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Types
   class BaseObject < GraphQL::Schema::Object
   end

data/spec/dummy/app/graphql/types/custom_admin_type.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Types
   class CustomAdminType < GraphQL::Schema::Object
     field :email,        String, null: false

data/spec/dummy/app/graphql/types/mutation_type.rb

@@ -1,6 +1,9 @@
+# frozen_string_literal: true
+
 module Types
   class MutationType < Types::BaseObject
-    field :dummy_mutation, String, null: false
+    field :dummy_mutation, String, null: false, authenticate: true
+    field :update_user, mutation: Mutations::UpdateUser
 
     def dummy_mutation
       'Necessary so GraphQL gem does not complain about empty mutation type'

data/spec/dummy/app/graphql/types/query_type.rb

@@ -1,5 +1,17 @@
+# frozen_string_literal: true
+
 module Types
   class QueryType < Types::BaseObject
     field :user, resolver: Resolvers::UserShow
+    field :public_field, String, null: false, authenticate: false
+    field :private_field, String, null: false, authenticate: true
+
+    def public_field
+      'Field does not require authentication'
+    end
+
+    def private_field
+      'Field will always require authentication'
+    end
   end
 end

data/spec/dummy/app/graphql/types/user_type.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Types
   class UserType < GraphQL::Schema::Object
     field :id,            Int,    null: false

data/spec/dummy/app/jobs/application_job.rb

@@ -1,2 +1,4 @@
+# frozen_string_literal: true
+
 class ApplicationJob < ActiveJob::Base
 end

data/spec/dummy/app/mailers/application_mailer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class ApplicationMailer < ActionMailer::Base
   default from: 'from@example.com'
   layout 'mailer'

data/spec/dummy/app/models/admin.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Admin < ApplicationRecord
   devise :database_authenticatable,
          :registerable,

data/spec/dummy/app/models/application_record.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class ApplicationRecord < ActiveRecord::Base
   self.abstract_class = true
 end

data/spec/dummy/app/models/guest.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class Guest < ApplicationRecord
   devise :database_authenticatable,
          :registerable,

data/spec/dummy/app/models/schema_user.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class SchemaUser < ApplicationRecord
+  devise :database_authenticatable,
+         :recoverable,
+         :trackable,
+         :validatable,
+         :confirmable
+
+  include GraphqlDevise::Concerns::Model
+
+  validates :name, presence: true
+end

data/spec/dummy/app/models/user.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class User < ApplicationRecord
   devise :database_authenticatable,
          :registerable,

data/spec/dummy/app/models/users.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Users
   def self.table_name_prefix
     'users_'

data/spec/dummy/app/models/users/customer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Users
   class Customer < ApplicationRecord
     devise :database_authenticatable, :validatable

data/spec/dummy/config.ru

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # This file is used by Rack-based servers to start the application.
 
 require_relative 'config/environment'