@envelop/generic-auth 2.0.0-alpha-c8eef8e.0 → 2.0.1-alpha-7ca7cb8.0

package/index.d.ts

@@ -1,21 +1,15 @@
 import { DefaultContext, Plugin } from '@envelop/core';
-import { DirectiveNode, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
+import { DirectiveNode, GraphQLError, GraphQLResolveInfo } from 'graphql';
+export * from './utils';
 export declare class UnauthenticatedError extends GraphQLError {
 }
 export declare type ResolveUserFn<UserType, ContextType = DefaultContext> = (context: ContextType) => null | UserType | Promise<UserType | null>;
-export declare type ValidateUserFnParams<UserType> = {
-    /** The user object. */
-    user: UserType;
-    /** The field node from the operation that is being validated. */
-    fieldNode: FieldNode;
-    /** The object type which has the field that is being validated. */
-    objectType: GraphQLObjectType;
-    /** The directive node used for the authentication (If using an SDL flow). */
-    fieldAuthDirectiveNode: DirectiveNode | undefined;
-    /** The extensions used for authentication (If using an extension based flow). */
-    fieldAuthExtension: unknown | undefined;
-};
-export declare type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | UnauthenticatedError;
+export declare type ValidateUserFn<UserType, ContextType = DefaultContext> = (user: UserType, context: ContextType, resolverInfo?: {
+    root: unknown;
+    args: Record<string, unknown>;
+    context: ContextType;
+    info: GraphQLResolveInfo;
+}, directiveNode?: DirectiveNode) => void | Promise<void>;
 export declare const DIRECTIVE_SDL = "\n  directive @auth on FIELD_DEFINITION\n";
 export declare const SKIP_AUTH_DIRECTIVE_SDL = "\n  directive @skipAuth on FIELD_DEFINITION\n";
 export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextType extends DefaultContext = DefaultContext> = {
@@ -26,6 +20,11 @@ export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextTy
      * Make sure to either return `null` or the user object.
      */
     resolveUserFn: ResolveUserFn<UserType, ContextType>;
+    /**
+     * Here you can implement any custom to check if the user is valid and have access to the server.
+     * This method is being triggered in different flows, besed on the mode you chose to implement.
+     */
+    validateUser?: ValidateUserFn<UserType, ContextType>;
     /**
      * Overrides the default field name for injecting the user into the execution `context`.
      * @default currentUser
@@ -43,12 +42,6 @@ export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextTy
      * @default skipAuth
      */
     authDirectiveName?: 'skipAuth' | string;
-    /**
-     * Customize how the user is validated. E.g. apply authorization role based validation.
-     * The validation is applied during the extended validation phase.
-     * @default `defaultProtectAllValidateFn`
-     */
-    validateUser?: ValidateUserFn<UserType>;
 } | {
     /**
      * Just resolves the user and inject to authenticated user into the `context`.
@@ -60,21 +53,14 @@ export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextTy
      * resolves the user and inject to authenticated user into the `context`.
      * And checks for `@auth` directives usages to run validation automatically.
      */
-    mode: 'protect-single';
+    mode: 'protect-auth-directive';
     /**
      * Overrides the default directive name
      * @default auth
      */
     authDirectiveName?: 'auth' | string;
-    /**
-     * Customize how the user is validated. E.g. apply authorization role based validation.
-     * The validation is applied during the extended validation phase.
-     * @default `defaultProtectSingleValidateFn`
-     */
-    validateUser?: ValidateUserFn<UserType>;
 });
-export declare function defaultProtectAllValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
-export declare function defaultProtectSingleValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
+export declare function defaultValidateFn<UserType, ContextType>(user: UserType, contextType: ContextType): void;
 export declare const useGenericAuth: <UserType extends {} = {}, ContextType extends DefaultContext = DefaultContext>(options: GenericAuthPluginOptions<UserType, ContextType>) => Plugin<{
-    validateUser: ValidateUserFn<UserType>;
+    validateUser: ValidateUserFn<UserType, ContextType>;
 }>;

package/index.js

@@ -3,7 +3,16 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 const graphql = require('graphql');
-const extendedValidation = require('@envelop/extended-validation');
+
+function getDirective(info, name) {
+    var _a;
+    const { parentType, fieldName, schema } = info;
+    const schemaType = schema.getType(parentType.name);
+    const field = schemaType.getFields()[fieldName];
+    const astNode = field.astNode;
+    const authDirective = (_a = astNode === null || astNode === void 0 ? void 0 : astNode.directives) === null || _a === void 0 ? void 0 : _a.find(d => d.name.value === name);
+    return authDirective || null;
+}
 
 class UnauthenticatedError extends graphql.GraphQLError {
 }
@@ -13,87 +22,33 @@ const DIRECTIVE_SDL = /* GraphQL */ `
 const SKIP_AUTH_DIRECTIVE_SDL = /* GraphQL */ `
   directive @skipAuth on FIELD_DEFINITION
 `;
-function defaultProtectAllValidateFn(params) {
-    if (params.user == null && !params.fieldAuthDirectiveNode && !params.fieldAuthExtension) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
-    }
-}
-function defaultProtectSingleValidateFn(params) {
-    if (params.user == null && (params.fieldAuthDirectiveNode || params.fieldAuthExtension)) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
+function defaultValidateFn(user, contextType) {
+    if (!user) {
+        throw new UnauthenticatedError('Unauthenticated!');
     }
 }
 const useGenericAuth = (options) => {
-    var _a, _b;
-    const contextFieldName = options.contextFieldName || 'currentUser';
-    if (options.mode === 'protect-all' || options.mode === 'protect-single') {
-        const directiveName = (_a = options.authDirectiveName) !== null && _a !== void 0 ? _a : (options.mode === 'protect-all' ? 'skipAuth' : 'auth');
-        const validateUser = (_b = options.validateUser) !== null && _b !== void 0 ? _b : (options.mode === 'protect-all' ? defaultProtectAllValidateFn : defaultProtectSingleValidateFn);
-        const extractAuthMeta = (input) => {
-            var _a, _b, _c;
-            return {
-                fieldAuthExtension: (_a = input.extensions) === null || _a === void 0 ? void 0 : _a[directiveName],
-                fieldAuthDirectiveNode: (_c = (_b = input.astNode) === null || _b === void 0 ? void 0 : _b.directives) === null || _c === void 0 ? void 0 : _c.find(directive => directive.name.value === directiveName),
-            };
-        };
+    const fieldName = options.contextFieldName || 'currentUser';
+    const validateUser = options.validateUser || defaultValidateFn;
+    if (options.mode === 'protect-all') {
         return {
-            onPluginInit({ addPlugin }) {
-                addPlugin(extendedValidation.useExtendedValidation({
-                    rules: [
-                        function AuthorizationExtendedValidationRule(context, args) {
-                            const user = args.contextValue[contextFieldName];
-                            const handleField = (fieldNode, objectType) => {
-                                const field = objectType.getFields()[fieldNode.name.value];
-                                if (field == null) {
-                                    // field is null/undefined if this is an introspection field
-                                    return;
-                                }
-                                const { fieldAuthExtension, fieldAuthDirectiveNode } = extractAuthMeta(field);
-                                const error = validateUser({
-                                    user,
-                                    fieldNode,
-                                    objectType,
-                                    fieldAuthDirectiveNode,
-                                    fieldAuthExtension,
-                                });
-                                if (error) {
-                                    context.reportError(error);
-                                }
-                            };
-                            return {
-                                Field(node) {
-                                    const fieldType = graphql.getNamedType(context.getParentType());
-                                    if (graphql.isIntrospectionType(fieldType)) {
-                                        return false;
-                                    }
-                                    if (graphql.isObjectType(fieldType)) {
-                                        handleField(node, fieldType);
-                                    }
-                                    else if (graphql.isUnionType(fieldType)) {
-                                        for (const objectType of fieldType.getTypes()) {
-                                            handleField(node, objectType);
-                                        }
-                                    }
-                                    else if (graphql.isInterfaceType(fieldType)) {
-                                        for (const objectType of args.schema.getImplementations(fieldType).objects) {
-                                            handleField(node, objectType);
-                                        }
-                                    }
-                                    return undefined;
-                                },
-                            };
-                        },
-                    ],
-                }));
-            },
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [contextFieldName]: user,
+                    [fieldName]: user,
+                    validateUser,
                 });
             },
+            onExecute() {
+                return {
+                    async onResolverCalled({ args, root, context, info }) {
+                        const authDirectiveNode = getDirective(info, options.authDirectiveName || 'skipAuth');
+                        if (authDirectiveNode)
+                            return;
+                        await context.validateUser(context[fieldName], context);
+                    },
+                };
+            },
         };
     }
     else if (options.mode === 'resolve-only') {
@@ -101,9 +56,36 @@ const useGenericAuth = (options) => {
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [contextFieldName]: user,
+                    [fieldName]: user,
+                    validateUser: () => validateUser(user, context),
+                });
+            },
+        };
+    }
+    else if (options.mode === 'protect-auth-directive') {
+        return {
+            async onContextBuilding({ context, extendContext }) {
+                const user = await options.resolveUserFn(context);
+                extendContext({
+                    [fieldName]: user,
+                    validateUser,
                 });
             },
+            onExecute() {
+                return {
+                    async onResolverCalled({ args, root, context, info }) {
+                        const authDirectiveNode = getDirective(info, options.authDirectiveName || 'auth');
+                        if (authDirectiveNode) {
+                            await context.validateUser(context[fieldName], context, {
+                                info,
+                                context: context,
+                                args,
+                                root,
+                            }, authDirectiveNode);
+                        }
+                    },
+                };
+            },
         };
     }
     return {};
@@ -112,6 +94,6 @@ const useGenericAuth = (options) => {
 exports.DIRECTIVE_SDL = DIRECTIVE_SDL;
 exports.SKIP_AUTH_DIRECTIVE_SDL = SKIP_AUTH_DIRECTIVE_SDL;
 exports.UnauthenticatedError = UnauthenticatedError;
-exports.defaultProtectAllValidateFn = defaultProtectAllValidateFn;
-exports.defaultProtectSingleValidateFn = defaultProtectSingleValidateFn;
+exports.defaultValidateFn = defaultValidateFn;
+exports.getDirective = getDirective;
 exports.useGenericAuth = useGenericAuth;

package/index.mjs

@@ -1,5 +1,14 @@
-import { GraphQLError, getNamedType, isIntrospectionType, isObjectType, isUnionType, isInterfaceType } from 'graphql';
-import { useExtendedValidation } from '@envelop/extended-validation';
+import { GraphQLError } from 'graphql';
+
+function getDirective(info, name) {
+    var _a;
+    const { parentType, fieldName, schema } = info;
+    const schemaType = schema.getType(parentType.name);
+    const field = schemaType.getFields()[fieldName];
+    const astNode = field.astNode;
+    const authDirective = (_a = astNode === null || astNode === void 0 ? void 0 : astNode.directives) === null || _a === void 0 ? void 0 : _a.find(d => d.name.value === name);
+    return authDirective || null;
+}
 
 class UnauthenticatedError extends GraphQLError {
 }
@@ -9,87 +18,33 @@ const DIRECTIVE_SDL = /* GraphQL */ `
 const SKIP_AUTH_DIRECTIVE_SDL = /* GraphQL */ `
   directive @skipAuth on FIELD_DEFINITION
 `;
-function defaultProtectAllValidateFn(params) {
-    if (params.user == null && !params.fieldAuthDirectiveNode && !params.fieldAuthExtension) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
-    }
-}
-function defaultProtectSingleValidateFn(params) {
-    if (params.user == null && (params.fieldAuthDirectiveNode || params.fieldAuthExtension)) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
+function defaultValidateFn(user, contextType) {
+    if (!user) {
+        throw new UnauthenticatedError('Unauthenticated!');
     }
 }
 const useGenericAuth = (options) => {
-    var _a, _b;
-    const contextFieldName = options.contextFieldName || 'currentUser';
-    if (options.mode === 'protect-all' || options.mode === 'protect-single') {
-        const directiveName = (_a = options.authDirectiveName) !== null && _a !== void 0 ? _a : (options.mode === 'protect-all' ? 'skipAuth' : 'auth');
-        const validateUser = (_b = options.validateUser) !== null && _b !== void 0 ? _b : (options.mode === 'protect-all' ? defaultProtectAllValidateFn : defaultProtectSingleValidateFn);
-        const extractAuthMeta = (input) => {
-            var _a, _b, _c;
-            return {
-                fieldAuthExtension: (_a = input.extensions) === null || _a === void 0 ? void 0 : _a[directiveName],
-                fieldAuthDirectiveNode: (_c = (_b = input.astNode) === null || _b === void 0 ? void 0 : _b.directives) === null || _c === void 0 ? void 0 : _c.find(directive => directive.name.value === directiveName),
-            };
-        };
+    const fieldName = options.contextFieldName || 'currentUser';
+    const validateUser = options.validateUser || defaultValidateFn;
+    if (options.mode === 'protect-all') {
         return {
-            onPluginInit({ addPlugin }) {
-                addPlugin(useExtendedValidation({
-                    rules: [
-                        function AuthorizationExtendedValidationRule(context, args) {
-                            const user = args.contextValue[contextFieldName];
-                            const handleField = (fieldNode, objectType) => {
-                                const field = objectType.getFields()[fieldNode.name.value];
-                                if (field == null) {
-                                    // field is null/undefined if this is an introspection field
-                                    return;
-                                }
-                                const { fieldAuthExtension, fieldAuthDirectiveNode } = extractAuthMeta(field);
-                                const error = validateUser({
-                                    user,
-                                    fieldNode,
-                                    objectType,
-                                    fieldAuthDirectiveNode,
-                                    fieldAuthExtension,
-                                });
-                                if (error) {
-                                    context.reportError(error);
-                                }
-                            };
-                            return {
-                                Field(node) {
-                                    const fieldType = getNamedType(context.getParentType());
-                                    if (isIntrospectionType(fieldType)) {
-                                        return false;
-                                    }
-                                    if (isObjectType(fieldType)) {
-                                        handleField(node, fieldType);
-                                    }
-                                    else if (isUnionType(fieldType)) {
-                                        for (const objectType of fieldType.getTypes()) {
-                                            handleField(node, objectType);
-                                        }
-                                    }
-                                    else if (isInterfaceType(fieldType)) {
-                                        for (const objectType of args.schema.getImplementations(fieldType).objects) {
-                                            handleField(node, objectType);
-                                        }
-                                    }
-                                    return undefined;
-                                },
-                            };
-                        },
-                    ],
-                }));
-            },
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [contextFieldName]: user,
+                    [fieldName]: user,
+                    validateUser,
                 });
             },
+            onExecute() {
+                return {
+                    async onResolverCalled({ args, root, context, info }) {
+                        const authDirectiveNode = getDirective(info, options.authDirectiveName || 'skipAuth');
+                        if (authDirectiveNode)
+                            return;
+                        await context.validateUser(context[fieldName], context);
+                    },
+                };
+            },
         };
     }
     else if (options.mode === 'resolve-only') {
@@ -97,12 +52,39 @@ const useGenericAuth = (options) => {
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [contextFieldName]: user,
+                    [fieldName]: user,
+                    validateUser: () => validateUser(user, context),
+                });
+            },
+        };
+    }
+    else if (options.mode === 'protect-auth-directive') {
+        return {
+            async onContextBuilding({ context, extendContext }) {
+                const user = await options.resolveUserFn(context);
+                extendContext({
+                    [fieldName]: user,
+                    validateUser,
                 });
             },
+            onExecute() {
+                return {
+                    async onResolverCalled({ args, root, context, info }) {
+                        const authDirectiveNode = getDirective(info, options.authDirectiveName || 'auth');
+                        if (authDirectiveNode) {
+                            await context.validateUser(context[fieldName], context, {
+                                info,
+                                context: context,
+                                args,
+                                root,
+                            }, authDirectiveNode);
+                        }
+                    },
+                };
+            },
         };
     }
     return {};
 };
 
-export { DIRECTIVE_SDL, SKIP_AUTH_DIRECTIVE_SDL, UnauthenticatedError, defaultProtectAllValidateFn, defaultProtectSingleValidateFn, useGenericAuth };
+export { DIRECTIVE_SDL, SKIP_AUTH_DIRECTIVE_SDL, UnauthenticatedError, defaultValidateFn, getDirective, useGenericAuth };

package/package.json

@@ -1,14 +1,11 @@
 {
   "name": "@envelop/generic-auth",
-  "version": "2.0.0-alpha-c8eef8e.0",
+  "version": "2.0.1-alpha-7ca7cb8.0",
   "sideEffects": false,
   "peerDependencies": {
-    "@envelop/core": "^1.6.1",
+    "@envelop/core": "1.7.2-alpha-7ca7cb8.0",
     "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0"
   },
-  "dependencies": {
-    "@envelop/extended-validation": "^1.3.1"
-  },
   "repository": {
     "type": "git",
     "url": "https://github.com/dotansimha/envelop.git",
@@ -30,6 +27,7 @@
     "./*": {
       "require": "./*.js",
       "import": "./*.mjs"
-    }
+    },
+    "./package.json": "./package.json"
   }
 }

package/utils.d.ts

@@ -0,0 +1,2 @@
+import { DirectiveNode, GraphQLResolveInfo } from 'graphql';
+export declare function getDirective(info: GraphQLResolveInfo, name: string): null | DirectiveNode;