hq-graphql 2.0.3 → 2.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b4eee6371389b2dc2b666235993adb716b2edaddb327e6f6a7676bbfbde909d8
-  data.tar.gz: 1e2d08f7882d72926842d76335f165621a3685b93a541e27c85bda12be5c4c8c
+  metadata.gz: d2877f7a77b6c2c63a91fe28cf21b64e99ebd92d6ec8e68c13acf3ed18911edb
+  data.tar.gz: 97781e7d915f98154c4f3252a7b244afbffd2d5a7920ff4c77d54b6e4409976f
 SHA512:
-  metadata.gz: 51c32bc6d94598f571f5b679efeab6d67ba1a3656f41c4c669c615ee414bae2d780bb2de80a92a11ceda730af49297a1418da4d448b843b17daf540ce9f89f2b
-  data.tar.gz: 9b42478cf51ad1e48f84604526caec0d1fc7d993f32f3e7f09fefd8299a911ca77a136fd4b1d11f52fed722afe61510f44c72c3d99e8f3d6fc246ecc0c9732d7
+  metadata.gz: 92120bf166668fd9e76cc0c42f0fc350ac7be0eacc9653f14f22b4a6c792910f9d3fbaf15ae0cfdbb596b6732c1dddbdaba24188e53d9a41cbae6cd2250b3659
+  data.tar.gz: 2ec3a9597f0059ec4c988534c355171489c958a43a1287f617d5056e33847bc9af67ea2572a93d3dd3d6b531443770218e543e3e2acc9131305d07217010f562

data/lib/hq/graphql/active_record_extensions.rb

@@ -18,8 +18,9 @@ module HQ
         include Kernel
 
         attr_accessor :model_name,
-                    :auto_load_attributes,
-                    :auto_load_associations
+                      :authorize_action,
+                      :auto_load_attributes,
+                      :auto_load_associations
 
         sig { params(block: T.nilable(T.proc.void)).returns(T::Array[T.proc.void]) }
         def lazy_load(&block)

data/lib/hq/graphql/config.rb

@@ -5,11 +5,14 @@
 module HQ
   module GraphQL
     class Config < T::Struct
+      AuthorizeProc = T.type_alias { T.nilable(T.proc.params(action: T.untyped, object: T.untyped, context: ::GraphQL::Query::Context).returns(T::Boolean)) }
+      prop :authorize, AuthorizeProc, default: nil
+
+      AuthorizeFieldProc = T.type_alias { T.nilable(T.proc.params(action: T.untyped, field: ::HQ::GraphQL::Field, object: T.untyped, context: ::GraphQL::Query::Context).returns(T::Boolean)) }
+      prop :authorize_field, AuthorizeFieldProc, default: nil
+
       DefaultScopeProc = T.type_alias { T.proc.params(arg0: T.untyped, arg1: ::GraphQL::Query::Context).returns(T.untyped) }
       prop :default_scope, DefaultScopeProc, default: ->(scope, _context) { scope }
-
-      AuthorizeProc = T.type_alias { T.proc.params(arg0: T.untyped, arg1: ::GraphQL::Query::Context).returns(T::Boolean) }
-      prop :authorize, AuthorizeProc, default: ->(_object, _context) { true }
     end
   end
 end

data/lib/hq/graphql/field.rb

@@ -1,4 +1,33 @@
+# typed: false
 # frozen_string_literal: true
 
-# typed: strict
-require "hq/graphql/field/association_loader"
+module HQ
+  module GraphQL
+    class Field < ::GraphQL::Schema::Field
+      attr_reader :authorize_action, :authorize, :klass
+
+      def initialize(*args, authorize_action: :read, authorize: nil, klass: nil, **options, &block)
+        super(*args, **options, &block)
+        @authorize_action = authorize_action
+        @authorize = authorize
+        @klass = klass
+      end
+
+      def authorized?(object, ctx)
+        super &&
+          (!authorize || authorize.call(object, ctx)) &&
+          ::HQ::GraphQL.authorize_field(authorize_action, self, object, ctx)
+      end
+
+      def resolve_field(object, args, ctx)
+        if klass.present? && !!::GraphQL::Batch::Executor.current && object.object
+          Loaders::Association.for(klass.constantize, original_name).load(object.object).then do
+            super
+          end
+        else
+          super
+        end
+      end
+    end
+  end
+end

data/lib/hq/graphql/object.rb

@@ -7,10 +7,14 @@ module HQ
       include Scalars
       include ::HQ::GraphQL::ActiveRecordExtensions
 
-      field_class ::HQ::GraphQL::Field::AssociationLoader
+      field_class ::HQ::GraphQL::Field
+
+      def self.authorize_action(action)
+        self.authorized_action = action
+      end
 
       def self.authorized?(object, context)
-        super && ::HQ::GraphQL.authorized?(object, context)
+        super && ::HQ::GraphQL.authorized?(authorized_action, object, context)
       end
 
       def self.with_model(model_name, attributes: true, associations: true, auto_nil: true)
@@ -36,15 +40,20 @@ module HQ
 
       class << self
         private
+        attr_writer :authorized_action
+
+        def authorized_action
+          @authorized_action ||= :read
+        end
 
         def field_from_association(association, auto_nil:)
           type = ::HQ::GraphQL::Types[association.klass]
           name = association.name
           case association.macro
           when :has_many
-            field name, [type], null: false, loader_klass: model_name
+            field name, [type], null: false, klass: model_name
           else
-            field name, type, null: !auto_nil || !association_required?(association), loader_klass: model_name
+            field name, type, null: !auto_nil || !association_required?(association), klass: model_name
           end
         rescue ::HQ::GraphQL::Types::Error
           nil

data/lib/hq/graphql/resource/mutation.rb

@@ -5,10 +5,14 @@ module HQ
   module GraphQL
     module Resource
       module Mutation
-        def self.build(model_name, graphql_name:, require_primary_key: false, nil_klass: false, &block)
+        def self.build(model_name, action:, graphql_name:, require_primary_key: false, nil_klass: false, &block)
           Class.new(::HQ::GraphQL::Mutation) do
             graphql_name graphql_name
 
+            define_method(:ready?) do |*args|
+              super(*args) && ::HQ::GraphQL.authorized?(action, model_name, context)
+            end
+
             lazy_load do
               field :errors, ::HQ::GraphQL::Types::Object, null: false
               field :resource, ::HQ::GraphQL::Types[model_name, nil_klass], null: true

data/lib/hq/graphql/resource.rb

@@ -78,7 +78,7 @@ module HQ
           scoped_self = self
 
           if create
-            create_mutation = ::HQ::GraphQL::Resource::Mutation.build(model_name, graphql_name: "#{scoped_graphql_name}Create") do
+            create_mutation = ::HQ::GraphQL::Resource::Mutation.build(model_name, action: :create, graphql_name: "#{scoped_graphql_name}Create") do
               define_method(:resolve) do |**args|
                 resource = scoped_self.new_record(context)
                 resource.assign_attributes(args[:attributes].format_nested_attributes)
@@ -106,6 +106,7 @@ module HQ
           if copy
             copy_mutation = ::HQ::GraphQL::Resource::Mutation.build(
               model_name,
+              action: :copy,
               graphql_name: "#{scoped_graphql_name}Copy",
               require_primary_key: true,
               nil_klass: true
@@ -141,6 +142,7 @@ module HQ
           if update
             update_mutation = ::HQ::GraphQL::Resource::Mutation.build(
               model_name,
+              action: :update,
               graphql_name: "#{scoped_graphql_name}Update",
               require_primary_key: true
             ) do
@@ -179,6 +181,7 @@ module HQ
           if destroy
             destroy_mutation = ::HQ::GraphQL::Resource::Mutation.build(
               model_name,
+              action: :destroy,
               graphql_name: "#{scoped_graphql_name}Destroy",
               require_primary_key: true
             ) do
@@ -224,7 +227,7 @@ module HQ
             end
           }
           ::HQ::GraphQL.root_queries << {
-            field_name: field_name, resolver: resolver
+            field_name: field_name, resolver: resolver, model_name: model_name
           }
         end
 

data/lib/hq/graphql/root_query.rb

@@ -8,8 +8,8 @@ module HQ
         super
         base.class_eval do
           lazy_load do
-            ::HQ::GraphQL.root_queries.each do |field_name:, resolver:|
-              field field_name, resolver: resolver.call
+            ::HQ::GraphQL.root_queries.each do |field_name:, resolver:, model_name:|
+              field field_name, resolver: resolver.call, klass: model_name
             end
           end
         end

data/lib/hq/graphql/version.rb

@@ -3,6 +3,6 @@
 
 module HQ
   module GraphQL
-    VERSION = "2.0.3"
+    VERSION = "2.0.4"
   end
 end

data/lib/hq/graphql.rb

@@ -5,6 +5,7 @@ require "rails"
 require "graphql"
 require "graphql/batch"
 require "sorbet-runtime"
+require "hq/graphql/field"
 require "hq/graphql/config"
 
 module HQ
@@ -23,9 +24,14 @@ module HQ
       config.instance_eval(&block)
     end
 
-    sig { params(object: T.untyped, context: ::GraphQL::Query::Context).returns(T::Boolean) }
-    def self.authorized?(object, context)
-      config.authorize.call(object, context)
+    sig { params(action: T.untyped, object: T.untyped, context: ::GraphQL::Query::Context).returns(T::Boolean) }
+    def self.authorized?(action, object, context)
+      !config.authorize || T.must(config.authorize).call(action, object, context)
+    end
+
+    sig { params(action: T.untyped, field: ::HQ::GraphQL::Field, object: T.untyped, context: ::GraphQL::Query::Context).returns(T::Boolean) }
+    def self.authorize_field(action, field, object, context)
+      !config.authorize_field || T.must(config.authorize_field).call(action, field, object, context)
     end
 
     sig { params(scope: T.untyped, context: ::GraphQL::Query::Context).returns(T.untyped) }
@@ -55,7 +61,6 @@ end
 require "hq/graphql/active_record_extensions"
 require "hq/graphql/scalars"
 
-require "hq/graphql/field"
 require "hq/graphql/inputs"
 require "hq/graphql/input_object"
 require "hq/graphql/loaders"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hq-graphql
 version: !ruby/object:Gem::Version
-  version: 2.0.3
+  version: 2.0.4
 platform: ruby
 authors:
 - Danny Jones
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-12 00:00:00.000000000 Z
+date: 2019-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -270,7 +270,6 @@ files:
 - lib/hq/graphql/config.rb
 - lib/hq/graphql/engine.rb
 - lib/hq/graphql/field.rb
-- lib/hq/graphql/field/association_loader.rb
 - lib/hq/graphql/input_object.rb
 - lib/hq/graphql/inputs.rb
 - lib/hq/graphql/loaders.rb

data/lib/hq/graphql/field/association_loader.rb

@@ -1,27 +0,0 @@
-# typed: false
-# frozen_string_literal: true
-
-module HQ
-  module GraphQL
-    module Field
-      class AssociationLoader < ::GraphQL::Schema::Field
-        attr_reader :loader_klass
-
-        def initialize(*args, loader_klass: nil, **options, &block)
-          super(*args, **options, &block)
-          @loader_klass = loader_klass
-        end
-
-        def resolve_field(object, args, ctx)
-          if loader_klass.present? && !!::GraphQL::Batch::Executor.current && object.object
-            Loaders::Association.for(loader_klass.constantize, original_name).load(object.object).then do
-              super
-            end
-          else
-            super
-          end
-        end
-      end
-    end
-  end
-end