@envelop/generic-auth 4.5.0 → 4.6.0-alpha-20220926041030-32b77a4b

package/README.md

@@ -256,7 +256,7 @@ const GraphQLQueryType = new GraphQLObjectType({
 
 > If you are using a different field extension for authentication, you can pass `directiveOrExtensionFieldName` configuration to customize it.
 
-##### Extend authentication with custom directive logic
+#### Extend authentication with custom logic
 
 You can also specify a custom `validateUser` function and get access to a handy object while using the `protect-all` and `protect-granular` mode:
 
@@ -274,7 +274,9 @@ const validateUser: ValidateUserFn<UserType> = async ({ user }) => {
 }
 ```
 
-And it's also possible to add custom parameters to your `@auth` directive. Here's an example for adding role-aware authentication:
+##### With a custom directive with arguments
+
+It is possible to add custom parameters to your `@auth` directive. Here's an example for adding role-aware authentication:
 
 ```graphql
 enum Role {
@@ -291,8 +293,8 @@ Then, you use the `directiveNode` parameter to check the arguments:
 import { ValidateUserFn } from '@envelop/generic-auth'
 
 const validateUser: ValidateUserFn<UserType> = async ({ user, fieldAuthDirectiveNode }) => {
-  // Now you can use the 3rd parameter to implement custom logic for user validation, with access
-  // to the resolver data and information.
+  // Now you can use the fieldAuthDirectiveNode parameter to implement custom logic for user validation, with access
+  // to the resolver auth directive arguments.
 
   if (!user) {
     throw new Error(`Unauthenticated!`)
@@ -306,3 +308,79 @@ const validateUser: ValidateUserFn<UserType> = async ({ user, fieldAuthDirective
   }
 }
 ```
+
+##### With a custom field extensions
+
+You can use custom field extension to pass data to your `validateUser` function instead of using a directive.
+Here's an example for adding role-aware authentication:
+
+```ts
+import { ValidateUserFn } from '@envelop/generic-auth'
+
+const validateUser: ValidateUserFn<UserType> = async ({ user, fieldAuthExtension }) => {
+  // Now you can use the fieldAuthDirectiveNode parameter to implement custom logic for user validation, with access
+  // to the resolver auth directive arguments.
+
+  if (!user) {
+    throw new Error(`Unauthenticated!`)
+  }
+
+  const role = fieldAuthExtension.role
+
+  if (role !== user.role) {
+    throw new Error(`No permissions!`)
+  }
+}
+
+const resolvers = {
+  Query: {
+    user: {
+      me: (_, __, { currentUser }) => currentUser,
+      extensions: {
+        auth: {
+          role: 'USER'
+        }
+      }
+    }
+  }
+}
+```
+
+##### With a custom validation function per field
+
+You can also have access to operation variables and context via the `executionArgs` parameter.
+This can be useful in conjunction with the `fieldAuthExtension` parameter to achieve custom per field validation.
+
+```ts
+import { ValidateUserFn } from '@envelop/generic-auth'
+
+const validateUser: ValidateUserFn<UserType> = async ({ user, executionArgs, fieldAuthExtension }) => {
+  if (!user) {
+    throw new Error(`Unauthenticated!`)
+  }
+
+  // You have access to the object define in the resolver tree, allowing to define any custom logic you want.
+  const validate = fieldAuthExtension?.validate
+  if (validate) {
+    await validate({ user, variables: executionArgs.variableValues, context: executionArgs.contextValue })
+  }
+}
+
+const resolvers = {
+  Query: {
+    user: {
+      resolve: (_, { userId }) => getUser(userId),
+      extensions: {
+        auth: {
+          validate: ({ user, variables, context }) => {
+            // We can now have access to the operation and variables to decide if the user can execute the query
+            if (user.id !== variables.userId) {
+              throw new Error(`Unauthorized`)
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```

package/cjs/index.js

@@ -58,6 +58,7 @@ const useGenericAuth = (options) => {
                                     objectType,
                                     fieldAuthDirectiveNode,
                                     fieldAuthExtension,
+                                    executionArgs: args,
                                 });
                                 if (error) {
                                     context.reportError(error);

package/esm/index.js

@@ -52,6 +52,7 @@ export const useGenericAuth = (options) => {
                                     objectType,
                                     fieldAuthDirectiveNode,
                                     fieldAuthExtension,
+                                    executionArgs: args,
                                 });
                                 if (error) {
                                     context.reportError(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envelop/generic-auth",
-  "version": "4.5.0",
+  "version": "4.6.0-alpha-20220926041030-32b77a4b",
   "sideEffects": false,
   "peerDependencies": {
     "@envelop/core": "^2.6.0",

package/typings/index.d.cts

@@ -1,5 +1,5 @@
 import { DefaultContext, Maybe, Plugin, PromiseOrValue } from '@envelop/core';
-import { DirectiveNode, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
+import { DirectiveNode, ExecutionArgs, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
 export declare class UnauthenticatedError extends GraphQLError {
 }
 export declare type ResolveUserFn<UserType, ContextType = DefaultContext> = (context: ContextType) => PromiseOrValue<Maybe<UserType>>;
@@ -14,6 +14,8 @@ export declare type ValidateUserFnParams<UserType> = {
     fieldAuthDirectiveNode: DirectiveNode | undefined;
     /** The extensions used for authentication (If using an extension based flow). */
     fieldAuthExtension: unknown | undefined;
+    /** The args passed to the execution function (including operation context and variables) **/
+    executionArgs: ExecutionArgs;
 };
 export declare type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | UnauthenticatedError;
 export declare const DIRECTIVE_SDL = "\n  directive @auth on FIELD_DEFINITION\n";

package/typings/index.d.ts

@@ -1,5 +1,5 @@
 import { DefaultContext, Maybe, Plugin, PromiseOrValue } from '@envelop/core';
-import { DirectiveNode, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
+import { DirectiveNode, ExecutionArgs, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
 export declare class UnauthenticatedError extends GraphQLError {
 }
 export declare type ResolveUserFn<UserType, ContextType = DefaultContext> = (context: ContextType) => PromiseOrValue<Maybe<UserType>>;
@@ -14,6 +14,8 @@ export declare type ValidateUserFnParams<UserType> = {
     fieldAuthDirectiveNode: DirectiveNode | undefined;
     /** The extensions used for authentication (If using an extension based flow). */
     fieldAuthExtension: unknown | undefined;
+    /** The args passed to the execution function (including operation context and variables) **/
+    executionArgs: ExecutionArgs;
 };
 export declare type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | UnauthenticatedError;
 export declare const DIRECTIVE_SDL = "\n  directive @auth on FIELD_DEFINITION\n";