@envelop/generic-auth 3.0.0 → 4.0.0-alpha-bed7c7d.0

package/index.d.ts

@@ -1,15 +1,21 @@
 import { DefaultContext, Plugin } from '@envelop/core';
-import { DirectiveNode, GraphQLError, GraphQLResolveInfo } from 'graphql';
-export * from './utils';
+import { DirectiveNode, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
 export declare class UnauthenticatedError extends GraphQLError {
 }
 export declare type ResolveUserFn<UserType, ContextType = DefaultContext> = (context: ContextType) => null | UserType | Promise<UserType | null>;
-export declare type ValidateUserFn<UserType, ContextType = DefaultContext> = (user: UserType, context: ContextType, resolverInfo?: {
-    root: unknown;
-    args: Record<string, unknown>;
-    context: ContextType;
-    info: GraphQLResolveInfo;
-}, directiveNode?: DirectiveNode) => void | Promise<void>;
+export declare type ValidateUserFnParams<UserType> = {
+    /** The user object. */
+    user: UserType;
+    /** The field node from the operation that is being validated. */
+    fieldNode: FieldNode;
+    /** The object type which has the field that is being validated. */
+    objectType: GraphQLObjectType;
+    /** The directive node used for the authentication (If using an SDL flow). */
+    fieldAuthDirectiveNode: DirectiveNode | undefined;
+    /** The extensions used for authentication (If using an extension based flow). */
+    fieldAuthExtension: unknown | undefined;
+};
+export declare type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | UnauthenticatedError;
 export declare const DIRECTIVE_SDL = "\n  directive @auth on FIELD_DEFINITION\n";
 export declare const SKIP_AUTH_DIRECTIVE_SDL = "\n  directive @skipAuth on FIELD_DEFINITION\n";
 export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextType extends DefaultContext = DefaultContext> = {
@@ -20,11 +26,6 @@ export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextTy
      * Make sure to either return `null` or the user object.
      */
     resolveUserFn: ResolveUserFn<UserType, ContextType>;
-    /**
-     * Here you can implement any custom to check if the user is valid and have access to the server.
-     * This method is being triggered in different flows, besed on the mode you chose to implement.
-     */
-    validateUser?: ValidateUserFn<UserType, ContextType>;
     /**
      * Overrides the default field name for injecting the user into the execution `context`.
      * @default currentUser
@@ -42,6 +43,12 @@ export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextTy
      * @default skipAuth
      */
     authDirectiveName?: 'skipAuth' | string;
+    /**
+     * Customize how the user is validated. E.g. apply authorization role based validation.
+     * The validation is applied during the extended validation phase.
+     * @default `defaultProtectAllValidateFn`
+     */
+    validateUser?: ValidateUserFn<UserType>;
 } | {
     /**
      * Just resolves the user and inject to authenticated user into the `context`.
@@ -53,14 +60,21 @@ export declare type GenericAuthPluginOptions<UserType extends {} = {}, ContextTy
      * resolves the user and inject to authenticated user into the `context`.
      * And checks for `@auth` directives usages to run validation automatically.
      */
-    mode: 'protect-auth-directive';
+    mode: 'protect-single';
     /**
      * Overrides the default directive name
      * @default auth
      */
     authDirectiveName?: 'auth' | string;
+    /**
+     * Customize how the user is validated. E.g. apply authorization role based validation.
+     * The validation is applied during the extended validation phase.
+     * @default `defaultProtectSingleValidateFn`
+     */
+    validateUser?: ValidateUserFn<UserType>;
 });
-export declare function defaultValidateFn<UserType, ContextType>(user: UserType, contextType: ContextType): void;
+export declare function defaultProtectAllValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
+export declare function defaultProtectSingleValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
 export declare const useGenericAuth: <UserType extends {} = {}, ContextType extends DefaultContext = DefaultContext>(options: GenericAuthPluginOptions<UserType, ContextType>) => Plugin<{
-    validateUser: ValidateUserFn<UserType, ContextType>;
+    validateUser: ValidateUserFn<UserType>;
 }>;

package/index.js

@@ -3,16 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 const graphql = require('graphql');
-
-function getDirective(info, name) {
-    var _a;
-    const { parentType, fieldName, schema } = info;
-    const schemaType = schema.getType(parentType.name);
-    const field = schemaType.getFields()[fieldName];
-    const astNode = field.astNode;
-    const authDirective = (_a = astNode === null || astNode === void 0 ? void 0 : astNode.directives) === null || _a === void 0 ? void 0 : _a.find(d => d.name.value === name);
-    return authDirective || null;
-}
+const extendedValidation = require('@envelop/extended-validation');
 
 class UnauthenticatedError extends graphql.GraphQLError {
 }
@@ -22,62 +13,97 @@ const DIRECTIVE_SDL = /* GraphQL */ `
 const SKIP_AUTH_DIRECTIVE_SDL = /* GraphQL */ `
   directive @skipAuth on FIELD_DEFINITION
 `;
-function defaultValidateFn(user, contextType) {
-    if (!user) {
-        throw new UnauthenticatedError('Unauthenticated!');
+function defaultProtectAllValidateFn(params) {
+    if (params.user == null && !params.fieldAuthDirectiveNode && !params.fieldAuthExtension) {
+        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
+        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
+    }
+}
+function defaultProtectSingleValidateFn(params) {
+    if (params.user == null && (params.fieldAuthDirectiveNode || params.fieldAuthExtension)) {
+        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
+        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
     }
 }
 const useGenericAuth = (options) => {
-    const fieldName = options.contextFieldName || 'currentUser';
-    const validateUser = options.validateUser || defaultValidateFn;
-    if (options.mode === 'protect-all') {
-        return {
-            async onContextBuilding({ context, extendContext }) {
-                const user = await options.resolveUserFn(context);
-                extendContext({
-                    [fieldName]: user,
-                    validateUser,
-                });
-            },
-            async onResolverCalled({ args, root, context, info }) {
-                const authDirectiveNode = getDirective(info, options.authDirectiveName || 'skipAuth');
-                if (authDirectiveNode)
-                    return;
-                await context.validateUser(context[fieldName], context);
-            },
+    var _a, _b;
+    const contextFieldName = options.contextFieldName || 'currentUser';
+    if (options.mode === 'protect-all' || options.mode === 'protect-single') {
+        const directiveName = (_a = options.authDirectiveName) !== null && _a !== void 0 ? _a : (options.mode === 'protect-all' ? 'skipAuth' : 'auth');
+        const validateUser = (_b = options.validateUser) !== null && _b !== void 0 ? _b : (options.mode === 'protect-all' ? defaultProtectAllValidateFn : defaultProtectSingleValidateFn);
+        const extractAuthMeta = (input) => {
+            var _a, _b, _c;
+            return {
+                fieldAuthExtension: (_a = input.extensions) === null || _a === void 0 ? void 0 : _a[directiveName],
+                fieldAuthDirectiveNode: (_c = (_b = input.astNode) === null || _b === void 0 ? void 0 : _b.directives) === null || _c === void 0 ? void 0 : _c.find(directive => directive.name.value === directiveName),
+            };
         };
-    }
-    else if (options.mode === 'resolve-only') {
         return {
+            onPluginInit({ addPlugin }) {
+                addPlugin(extendedValidation.useExtendedValidation({
+                    rules: [
+                        function AuthorizationExtendedValidationRule(context, args) {
+                            const user = args.contextValue[contextFieldName];
+                            const handleField = (fieldNode, objectType) => {
+                                const field = objectType.getFields()[fieldNode.name.value];
+                                if (field == null) {
+                                    // field is null/undefined if this is an introspection field
+                                    return;
+                                }
+                                const { fieldAuthExtension, fieldAuthDirectiveNode } = extractAuthMeta(field);
+                                const error = validateUser({
+                                    user,
+                                    fieldNode,
+                                    objectType,
+                                    fieldAuthDirectiveNode,
+                                    fieldAuthExtension,
+                                });
+                                if (error) {
+                                    context.reportError(error);
+                                }
+                            };
+                            return {
+                                Field(node) {
+                                    const fieldType = graphql.getNamedType(context.getParentType());
+                                    if (graphql.isIntrospectionType(fieldType)) {
+                                        return false;
+                                    }
+                                    if (graphql.isObjectType(fieldType)) {
+                                        handleField(node, fieldType);
+                                    }
+                                    else if (graphql.isUnionType(fieldType)) {
+                                        for (const objectType of fieldType.getTypes()) {
+                                            handleField(node, objectType);
+                                        }
+                                    }
+                                    else if (graphql.isInterfaceType(fieldType)) {
+                                        for (const objectType of args.schema.getImplementations(fieldType).objects) {
+                                            handleField(node, objectType);
+                                        }
+                                    }
+                                    return undefined;
+                                },
+                            };
+                        },
+                    ],
+                }));
+            },
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [fieldName]: user,
-                    validateUser: () => validateUser(user, context),
+                    [contextFieldName]: user,
                 });
             },
         };
     }
-    else if (options.mode === 'protect-auth-directive') {
+    else if (options.mode === 'resolve-only') {
         return {
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [fieldName]: user,
-                    validateUser,
+                    [contextFieldName]: user,
                 });
             },
-            async onResolverCalled({ args, root, context, info }) {
-                const authDirectiveNode = getDirective(info, options.authDirectiveName || 'auth');
-                if (authDirectiveNode) {
-                    await context.validateUser(context[fieldName], context, {
-                        info,
-                        context: context,
-                        args,
-                        root,
-                    }, authDirectiveNode);
-                }
-            },
         };
     }
     return {};
@@ -86,6 +112,6 @@ const useGenericAuth = (options) => {
 exports.DIRECTIVE_SDL = DIRECTIVE_SDL;
 exports.SKIP_AUTH_DIRECTIVE_SDL = SKIP_AUTH_DIRECTIVE_SDL;
 exports.UnauthenticatedError = UnauthenticatedError;
-exports.defaultValidateFn = defaultValidateFn;
-exports.getDirective = getDirective;
+exports.defaultProtectAllValidateFn = defaultProtectAllValidateFn;
+exports.defaultProtectSingleValidateFn = defaultProtectSingleValidateFn;
 exports.useGenericAuth = useGenericAuth;

package/index.mjs

@@ -1,14 +1,5 @@
-import { GraphQLError } from 'graphql';
-
-function getDirective(info, name) {
-    var _a;
-    const { parentType, fieldName, schema } = info;
-    const schemaType = schema.getType(parentType.name);
-    const field = schemaType.getFields()[fieldName];
-    const astNode = field.astNode;
-    const authDirective = (_a = astNode === null || astNode === void 0 ? void 0 : astNode.directives) === null || _a === void 0 ? void 0 : _a.find(d => d.name.value === name);
-    return authDirective || null;
-}
+import { GraphQLError, getNamedType, isIntrospectionType, isObjectType, isUnionType, isInterfaceType } from 'graphql';
+import { useExtendedValidation } from '@envelop/extended-validation';
 
 class UnauthenticatedError extends GraphQLError {
 }
@@ -18,65 +9,100 @@ const DIRECTIVE_SDL = /* GraphQL */ `
 const SKIP_AUTH_DIRECTIVE_SDL = /* GraphQL */ `
   directive @skipAuth on FIELD_DEFINITION
 `;
-function defaultValidateFn(user, contextType) {
-    if (!user) {
-        throw new UnauthenticatedError('Unauthenticated!');
+function defaultProtectAllValidateFn(params) {
+    if (params.user == null && !params.fieldAuthDirectiveNode && !params.fieldAuthExtension) {
+        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
+        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
+    }
+}
+function defaultProtectSingleValidateFn(params) {
+    if (params.user == null && (params.fieldAuthDirectiveNode || params.fieldAuthExtension)) {
+        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
+        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [params.fieldNode]);
     }
 }
 const useGenericAuth = (options) => {
-    const fieldName = options.contextFieldName || 'currentUser';
-    const validateUser = options.validateUser || defaultValidateFn;
-    if (options.mode === 'protect-all') {
-        return {
-            async onContextBuilding({ context, extendContext }) {
-                const user = await options.resolveUserFn(context);
-                extendContext({
-                    [fieldName]: user,
-                    validateUser,
-                });
-            },
-            async onResolverCalled({ args, root, context, info }) {
-                const authDirectiveNode = getDirective(info, options.authDirectiveName || 'skipAuth');
-                if (authDirectiveNode)
-                    return;
-                await context.validateUser(context[fieldName], context);
-            },
+    var _a, _b;
+    const contextFieldName = options.contextFieldName || 'currentUser';
+    if (options.mode === 'protect-all' || options.mode === 'protect-single') {
+        const directiveName = (_a = options.authDirectiveName) !== null && _a !== void 0 ? _a : (options.mode === 'protect-all' ? 'skipAuth' : 'auth');
+        const validateUser = (_b = options.validateUser) !== null && _b !== void 0 ? _b : (options.mode === 'protect-all' ? defaultProtectAllValidateFn : defaultProtectSingleValidateFn);
+        const extractAuthMeta = (input) => {
+            var _a, _b, _c;
+            return {
+                fieldAuthExtension: (_a = input.extensions) === null || _a === void 0 ? void 0 : _a[directiveName],
+                fieldAuthDirectiveNode: (_c = (_b = input.astNode) === null || _b === void 0 ? void 0 : _b.directives) === null || _c === void 0 ? void 0 : _c.find(directive => directive.name.value === directiveName),
+            };
         };
-    }
-    else if (options.mode === 'resolve-only') {
         return {
+            onPluginInit({ addPlugin }) {
+                addPlugin(useExtendedValidation({
+                    rules: [
+                        function AuthorizationExtendedValidationRule(context, args) {
+                            const user = args.contextValue[contextFieldName];
+                            const handleField = (fieldNode, objectType) => {
+                                const field = objectType.getFields()[fieldNode.name.value];
+                                if (field == null) {
+                                    // field is null/undefined if this is an introspection field
+                                    return;
+                                }
+                                const { fieldAuthExtension, fieldAuthDirectiveNode } = extractAuthMeta(field);
+                                const error = validateUser({
+                                    user,
+                                    fieldNode,
+                                    objectType,
+                                    fieldAuthDirectiveNode,
+                                    fieldAuthExtension,
+                                });
+                                if (error) {
+                                    context.reportError(error);
+                                }
+                            };
+                            return {
+                                Field(node) {
+                                    const fieldType = getNamedType(context.getParentType());
+                                    if (isIntrospectionType(fieldType)) {
+                                        return false;
+                                    }
+                                    if (isObjectType(fieldType)) {
+                                        handleField(node, fieldType);
+                                    }
+                                    else if (isUnionType(fieldType)) {
+                                        for (const objectType of fieldType.getTypes()) {
+                                            handleField(node, objectType);
+                                        }
+                                    }
+                                    else if (isInterfaceType(fieldType)) {
+                                        for (const objectType of args.schema.getImplementations(fieldType).objects) {
+                                            handleField(node, objectType);
+                                        }
+                                    }
+                                    return undefined;
+                                },
+                            };
+                        },
+                    ],
+                }));
+            },
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [fieldName]: user,
-                    validateUser: () => validateUser(user, context),
+                    [contextFieldName]: user,
                 });
             },
         };
     }
-    else if (options.mode === 'protect-auth-directive') {
+    else if (options.mode === 'resolve-only') {
         return {
             async onContextBuilding({ context, extendContext }) {
                 const user = await options.resolveUserFn(context);
                 extendContext({
-                    [fieldName]: user,
-                    validateUser,
+                    [contextFieldName]: user,
                 });
             },
-            async onResolverCalled({ args, root, context, info }) {
-                const authDirectiveNode = getDirective(info, options.authDirectiveName || 'auth');
-                if (authDirectiveNode) {
-                    await context.validateUser(context[fieldName], context, {
-                        info,
-                        context: context,
-                        args,
-                        root,
-                    }, authDirectiveNode);
-                }
-            },
         };
     }
     return {};
 };
 
-export { DIRECTIVE_SDL, SKIP_AUTH_DIRECTIVE_SDL, UnauthenticatedError, defaultValidateFn, getDirective, useGenericAuth };
+export { DIRECTIVE_SDL, SKIP_AUTH_DIRECTIVE_SDL, UnauthenticatedError, defaultProtectAllValidateFn, defaultProtectSingleValidateFn, useGenericAuth };

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "@envelop/generic-auth",
-  "version": "3.0.0",
+  "version": "4.0.0-alpha-bed7c7d.0",
   "sideEffects": false,
   "peerDependencies": {
     "@envelop/core": "^2.0.0",
     "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0"
   },
+  "dependencies": {
+    "@envelop/extended-validation": "^1.3.1"
+  },
   "repository": {
     "type": "git",
     "url": "https://github.com/dotansimha/envelop.git",

package/utils.d.ts

@@ -1,2 +0,0 @@
-import { DirectiveNode, GraphQLResolveInfo } from 'graphql';
-export declare function getDirective(info: GraphQLResolveInfo, name: string): null | DirectiveNode;