@envelop/generic-auth 7.0.0 → 8.0.0-alpha-20240806125641-9b9885ba

package/README.md

@@ -4,8 +4,8 @@ This plugin allows you to implement custom authentication flow by providing a cu
 based on the original HTTP request. The resolved user is injected into the GraphQL execution
 `context`, and you can use it in your resolvers to fetch the current user.
 
-> The plugin also comes with an optional `@auth` directive that can be added to your GraphQL schema
-> and helps you to protect your GraphQL schema in a declarative way.
+> The plugin also comes with an optional `@authenticated` directive that can be added to your
+> GraphQL schema and helps you to protect your GraphQL schema in a declarative way.
 
 There are several possible flows for using this plugin (see below for setup examples):
 
@@ -15,8 +15,8 @@ There are several possible flows for using this plugin (see below for setup exam
 - **Option #2 - Manual Validation**: the plugin will just resolve the user and injects it into the
   `context` without validating access to schema field.
 - **Option #3 - Granular field access by using schema field directives or field extensions**: Look
-  for an `@auth` directive or `auth` extension field and automatically protect those specific
-  GraphQL fields.
+  for an `@authenticated` directive or `authenticated` extension field and automatically protect
+  those specific GraphQL fields.
 
 ## Getting Started
 
@@ -70,7 +70,7 @@ const validateUser: ValidateUserFn<UserType> = params => {
   // This method is being triggered in different flows, based on the mode you chose to implement.
 
   // If you are using the `protect-auth-directive` mode, you'll also get 2 additional parameters: the resolver parameters as object and the DirectiveNode of the auth directive.
-  // In `protect-auth-directive` mode, this function will always get called and you can use these parameters to check if the field has the `@auth` or `@skipAuth` directive
+  // In `protect-auth-directive` mode, this function will always get called and you can use these parameters to check if the field has the `@authenticated` or `@skipAuth` directive
 
   if (!user) {
     return new Error(`Unauthenticated!`)
@@ -175,7 +175,7 @@ type UserType = {
 const resolveUserFn: ResolveUserFn<UserType> = async context => {
   /* ... */
 }
-const validateUser: ValidateUserFn<UserType> = async params => {
+const validateUser: ValidateUserFn<UserType> = params => {
   /* ... */
 }
 
@@ -198,7 +198,11 @@ Then, in your resolvers, you can execute the check method based on your needs:
 const resolvers = {
   Query: {
     me: async (root, args, context) => {
-      await context.validateUser()
+      const validationError = context.validateUser()
+      if (validationError) {
+        throw validationError
+      }
+
       const currentUser = context.currentUser
 
       return currentUser
@@ -209,8 +213,8 @@ const resolvers = {
 
 #### Option #3 - `protect-granular`
 
-This mode is similar to option #2, but it uses the `@auth` SDL directive or `auth` field extension
-for protecting specific GraphQL fields.
+This mode is similar to option #2, but it uses the `@authenticated` SDL directive or `auth` field
+extension for protecting specific GraphQL fields.
 
 ```ts
 import { execute, parse, specifiedRules, subscribe, validate } from 'graphql'
@@ -243,15 +247,15 @@ const getEnveloped = envelop({
 ##### Protect a field using a field `directive`
 
 > By default, we assume that you have the GraphQL directive definition as part of your GraphQL
-> schema (`directive @auth on FIELD_DEFINITION`).
+> schema (`directive @authenticated on FIELD_DEFINITION`).
 
-Then, in your GraphQL schema SDL, you can add `@auth` directive to your fields, and the
+Then, in your GraphQL schema SDL, you can add `@authenticated` directive to your fields, and the
 `validateUser` will get called only while resolving that specific field:
 
 ```graphql
 type Query {
-  me: User! @auth
-  protectedField: String @auth
+  me: User! @authenticated
+  protectedField: String @authenticated
   # publicField: String
 }
 ```
@@ -273,7 +277,7 @@ const GraphQLQueryType = new GraphQLObjectType({
       type: GraphQLInt,
       resolve: () => 1,
       extensions: {
-        auth: true
+        authenticated: true
       }
     }
   }
@@ -292,7 +296,7 @@ the `protect-all` and `protect-granular` mode:
 import { GraphQLError } from 'graphql'
 import { ValidateUserFn } from '@envelop/generic-auth'
 
-const validateUser: ValidateUserFn<UserType> = async ({ user }) => {
+const validateUser: ValidateUserFn<UserType> = ({ user }) => {
   // Now you can use the 3rd parameter to implement custom logic for user validation, with access
   // to the resolver data and information.
 
@@ -304,8 +308,8 @@ const validateUser: ValidateUserFn<UserType> = async ({ user }) => {
 
 ##### With a custom directive with arguments
 
-It is possible to add custom parameters to your `@auth` directive. Here's an example for adding
-role-aware authentication:
+It is possible to add custom parameters to your `@authenticated` directive. Here's an example for
+adding role-aware authentication:
 
 ```graphql
 enum Role {
@@ -313,7 +317,7 @@ enum Role {
   MEMBER
 }
 
-directive @auth(role: Role!) on FIELD_DEFINITION
+directive @authenticated(role: Role!) on FIELD_DEFINITION
 ```
 
 Then, you use the `directiveNode` parameter to check the arguments:
@@ -321,7 +325,7 @@ Then, you use the `directiveNode` parameter to check the arguments:
 ```ts
 import { ValidateUserFn } from '@envelop/generic-auth'
 
-const validateUser: ValidateUserFn<UserType> = async ({ user, fieldAuthDirectiveNode }) => {
+const validateUser: ValidateUserFn<UserType> = ({ user, fieldAuthDirectiveNode }) => {
   // Now you can use the fieldAuthDirectiveNode parameter to implement custom logic for user validation, with access
   // to the resolver auth directive arguments.
 
@@ -367,7 +371,7 @@ const resolvers = {
     user: {
       me: (_, __, { currentUser }) => currentUser,
       extensions: {
-        auth: {
+        authenticated: {
           role: 'USER'
         }
       }
@@ -385,11 +389,7 @@ validation.
 ```ts
 import { ValidateUserFn } from '@envelop/generic-auth'
 
-const validateUser: ValidateUserFn<UserType> = async ({
-  user,
-  executionArgs,
-  fieldAuthExtension
-}) => {
+const validateUser: ValidateUserFn<UserType> = ({ user, executionArgs, fieldAuthExtension }) => {
   if (!user) {
     return new Error(`Unauthenticated!`)
   }
@@ -397,7 +397,7 @@ const validateUser: ValidateUserFn<UserType> = async ({
   // You have access to the object define in the resolver tree, allowing to define any custom logic you want.
   const validate = fieldAuthExtension?.validate
   if (validate) {
-    await validate({
+    return validate({
       user,
       variables: executionArgs.variableValues,
       context: executionArgs.contextValue
@@ -410,7 +410,7 @@ const resolvers = {
     user: {
       resolve: (_, { userId }) => getUser(userId),
       extensions: {
-        auth: {
+        authenticated: {
           validate: ({ user, variables, context }) => {
             // We can now have access to the operation and variables to decide if the user can execute the query
             if (user.id !== variables.userId) {

package/cjs/index.js

@@ -1,33 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.useGenericAuth = exports.defaultProtectSingleValidateFn = exports.defaultProtectAllValidateFn = exports.SKIP_AUTH_DIRECTIVE_SDL = exports.DIRECTIVE_SDL = exports.UnauthenticatedError = void 0;
+exports.useGenericAuth = exports.defaultProtectSingleValidateFn = exports.defaultProtectAllValidateFn = exports.createUnauthenticatedError = exports.SKIP_AUTH_DIRECTIVE_SDL = exports.DIRECTIVE_SDL = void 0;
 const graphql_1 = require("graphql");
 const extended_validation_1 = require("@envelop/extended-validation");
 const utils_1 = require("@graphql-tools/utils");
-class UnauthenticatedError extends graphql_1.GraphQLError {
-}
-exports.UnauthenticatedError = UnauthenticatedError;
 exports.DIRECTIVE_SDL = `
-  directive @auth on FIELD_DEFINITION
+  directive @authenticated on FIELD_DEFINITION
 `;
 exports.SKIP_AUTH_DIRECTIVE_SDL = `
   directive @skipAuth on FIELD_DEFINITION
 `;
+function createUnauthenticatedError(params) {
+    return (0, utils_1.createGraphQLError)('Unauthorized field or type', {
+        nodes: params?.fieldNode ? [params.fieldNode] : undefined,
+        path: params?.path,
+        extensions: {
+            code: 'UNAUTHORIZED_FIELD_OR_TYPE',
+            http: {
+                status: params?.statusCode ?? 401,
+            },
+        },
+    });
+}
+exports.createUnauthenticatedError = createUnauthenticatedError;
 function defaultProtectAllValidateFn(params) {
     if (params.user == null && !params.fieldAuthDirectiveNode && !params.fieldAuthExtension) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [
-            params.fieldNode,
-        ]);
+        return createUnauthenticatedError({
+            fieldNode: params.fieldNode,
+            path: params.path,
+        });
     }
 }
 exports.defaultProtectAllValidateFn = defaultProtectAllValidateFn;
 function defaultProtectSingleValidateFn(params) {
     if (params.user == null && (params.fieldAuthDirectiveNode || params.fieldAuthExtension)) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [
-            params.fieldNode,
-        ]);
+        return createUnauthenticatedError({
+            fieldNode: params.fieldNode,
+            path: params.path,
+        });
     }
 }
 exports.defaultProtectSingleValidateFn = defaultProtectSingleValidateFn;
@@ -35,7 +45,7 @@ const useGenericAuth = (options) => {
     const contextFieldName = options.contextFieldName || 'currentUser';
     if (options.mode === 'protect-all' || options.mode === 'protect-granular') {
         const directiveOrExtensionFieldName = options.directiveOrExtensionFieldName ??
-            (options.mode === 'protect-all' ? 'skipAuth' : 'auth');
+            (options.mode === 'protect-all' ? 'skipAuth' : 'authenticated');
         const validateUser = options.validateUser ??
             (options.mode === 'protect-all'
                 ? defaultProtectAllValidateFn
@@ -46,51 +56,101 @@ const useGenericAuth = (options) => {
                 fieldAuthDirectiveNode: input.astNode?.directives?.find(directive => directive.name.value === directiveOrExtensionFieldName),
             };
         };
+        const rejectUnauthenticated = 'rejectUnauthenticated' in options ? options.rejectUnauthenticated !== false : true;
         return {
             onPluginInit({ addPlugin }) {
                 addPlugin((0, extended_validation_1.useExtendedValidation)({
+                    rejectOnErrors: rejectUnauthenticated,
                     rules: [
                         function AuthorizationExtendedValidationRule(context, args) {
+                            const operations = {};
+                            const fragments = {};
+                            for (const definition of args.document.definitions) {
+                                if (definition.kind === 'OperationDefinition') {
+                                    operations[definition.name?.value ?? args.operationName ?? 'Anonymous'] =
+                                        definition;
+                                }
+                                else if (definition.kind === 'FragmentDefinition') {
+                                    fragments[definition.name.value] = definition;
+                                }
+                            }
                             const user = args.contextValue[contextFieldName];
-                            const handleField = (fieldNode, objectType) => {
+                            const handleField = ({ node: fieldNode, path, }, objectType) => {
                                 const field = objectType.getFields()[fieldNode.name.value];
                                 if (field == null) {
                                     // field is null/undefined if this is an introspection field
                                     return;
                                 }
                                 const { fieldAuthExtension, fieldAuthDirectiveNode } = extractAuthMeta(field);
-                                const error = validateUser({
+                                const resolvePath = [];
+                                let curr = args.document;
+                                for (const pathItem of path) {
+                                    curr = curr[pathItem];
+                                    if (curr?.kind === 'Field') {
+                                        resolvePath.push(curr.name.value);
+                                    }
+                                }
+                                return validateUser({
                                     user,
                                     fieldNode,
                                     objectType,
                                     fieldAuthDirectiveNode,
                                     fieldAuthExtension,
                                     executionArgs: args,
+                                    field,
+                                    path: resolvePath,
                                 });
-                                if (error) {
-                                    context.reportError(error);
-                                }
                             };
                             return {
-                                Field(node) {
+                                Field(node, key, parent, path, ancestors) {
                                     if (!(0, utils_1.shouldIncludeNode)(args.variableValues, node)) {
                                         return;
                                     }
                                     const fieldType = (0, graphql_1.getNamedType)(context.getParentType());
                                     if ((0, graphql_1.isIntrospectionType)(fieldType)) {
-                                        return false;
+                                        return node;
                                     }
                                     if ((0, graphql_1.isObjectType)(fieldType)) {
-                                        handleField(node, fieldType);
+                                        const error = handleField({
+                                            node,
+                                            key,
+                                            parent,
+                                            path,
+                                            ancestors,
+                                        }, fieldType);
+                                        if (error) {
+                                            context.reportError(error);
+                                            return null;
+                                        }
                                     }
                                     else if ((0, graphql_1.isUnionType)(fieldType)) {
                                         for (const objectType of fieldType.getTypes()) {
-                                            handleField(node, objectType);
+                                            const error = handleField({
+                                                node,
+                                                key,
+                                                parent,
+                                                path,
+                                                ancestors,
+                                            }, objectType);
+                                            if (error) {
+                                                context.reportError(error);
+                                                return null;
+                                            }
                                         }
                                     }
                                     else if ((0, graphql_1.isInterfaceType)(fieldType)) {
                                         for (const objectType of args.schema.getImplementations(fieldType).objects) {
-                                            handleField(node, objectType);
+                                            const error = handleField({
+                                                node,
+                                                key,
+                                                parent,
+                                                path,
+                                                ancestors,
+                                            }, objectType);
+                                            if (error) {
+                                                context.reportError(error);
+                                                return null;
+                                            }
                                         }
                                     }
                                     return undefined;

package/esm/index.js

@@ -1,35 +1,45 @@
-import { getNamedType, GraphQLError, isInterfaceType, isIntrospectionType, isObjectType, isUnionType, } from 'graphql';
+import { getNamedType, isInterfaceType, isIntrospectionType, isObjectType, isUnionType, } from 'graphql';
 import { useExtendedValidation } from '@envelop/extended-validation';
-import { shouldIncludeNode } from '@graphql-tools/utils';
-export class UnauthenticatedError extends GraphQLError {
-}
+import { createGraphQLError, shouldIncludeNode } from '@graphql-tools/utils';
 export const DIRECTIVE_SDL = /* GraphQL */ `
-  directive @auth on FIELD_DEFINITION
+  directive @authenticated on FIELD_DEFINITION
 `;
 export const SKIP_AUTH_DIRECTIVE_SDL = /* GraphQL */ `
   directive @skipAuth on FIELD_DEFINITION
 `;
+export function createUnauthenticatedError(params) {
+    return createGraphQLError('Unauthorized field or type', {
+        nodes: params?.fieldNode ? [params.fieldNode] : undefined,
+        path: params?.path,
+        extensions: {
+            code: 'UNAUTHORIZED_FIELD_OR_TYPE',
+            http: {
+                status: params?.statusCode ?? 401,
+            },
+        },
+    });
+}
 export function defaultProtectAllValidateFn(params) {
     if (params.user == null && !params.fieldAuthDirectiveNode && !params.fieldAuthExtension) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [
-            params.fieldNode,
-        ]);
+        return createUnauthenticatedError({
+            fieldNode: params.fieldNode,
+            path: params.path,
+        });
     }
 }
 export function defaultProtectSingleValidateFn(params) {
     if (params.user == null && (params.fieldAuthDirectiveNode || params.fieldAuthExtension)) {
-        const schemaCoordinate = `${params.objectType.name}.${params.fieldNode.name.value}`;
-        return new UnauthenticatedError(`Accessing '${schemaCoordinate}' requires authentication.`, [
-            params.fieldNode,
-        ]);
+        return createUnauthenticatedError({
+            fieldNode: params.fieldNode,
+            path: params.path,
+        });
     }
 }
 export const useGenericAuth = (options) => {
     const contextFieldName = options.contextFieldName || 'currentUser';
     if (options.mode === 'protect-all' || options.mode === 'protect-granular') {
         const directiveOrExtensionFieldName = options.directiveOrExtensionFieldName ??
-            (options.mode === 'protect-all' ? 'skipAuth' : 'auth');
+            (options.mode === 'protect-all' ? 'skipAuth' : 'authenticated');
         const validateUser = options.validateUser ??
             (options.mode === 'protect-all'
                 ? defaultProtectAllValidateFn
@@ -40,51 +50,101 @@ export const useGenericAuth = (options) => {
                 fieldAuthDirectiveNode: input.astNode?.directives?.find(directive => directive.name.value === directiveOrExtensionFieldName),
             };
         };
+        const rejectUnauthenticated = 'rejectUnauthenticated' in options ? options.rejectUnauthenticated !== false : true;
         return {
             onPluginInit({ addPlugin }) {
                 addPlugin(useExtendedValidation({
+                    rejectOnErrors: rejectUnauthenticated,
                     rules: [
                         function AuthorizationExtendedValidationRule(context, args) {
+                            const operations = {};
+                            const fragments = {};
+                            for (const definition of args.document.definitions) {
+                                if (definition.kind === 'OperationDefinition') {
+                                    operations[definition.name?.value ?? args.operationName ?? 'Anonymous'] =
+                                        definition;
+                                }
+                                else if (definition.kind === 'FragmentDefinition') {
+                                    fragments[definition.name.value] = definition;
+                                }
+                            }
                             const user = args.contextValue[contextFieldName];
-                            const handleField = (fieldNode, objectType) => {
+                            const handleField = ({ node: fieldNode, path, }, objectType) => {
                                 const field = objectType.getFields()[fieldNode.name.value];
                                 if (field == null) {
                                     // field is null/undefined if this is an introspection field
                                     return;
                                 }
                                 const { fieldAuthExtension, fieldAuthDirectiveNode } = extractAuthMeta(field);
-                                const error = validateUser({
+                                const resolvePath = [];
+                                let curr = args.document;
+                                for (const pathItem of path) {
+                                    curr = curr[pathItem];
+                                    if (curr?.kind === 'Field') {
+                                        resolvePath.push(curr.name.value);
+                                    }
+                                }
+                                return validateUser({
                                     user,
                                     fieldNode,
                                     objectType,
                                     fieldAuthDirectiveNode,
                                     fieldAuthExtension,
                                     executionArgs: args,
+                                    field,
+                                    path: resolvePath,
                                 });
-                                if (error) {
-                                    context.reportError(error);
-                                }
                             };
                             return {
-                                Field(node) {
+                                Field(node, key, parent, path, ancestors) {
                                     if (!shouldIncludeNode(args.variableValues, node)) {
                                         return;
                                     }
                                     const fieldType = getNamedType(context.getParentType());
                                     if (isIntrospectionType(fieldType)) {
-                                        return false;
+                                        return node;
                                     }
                                     if (isObjectType(fieldType)) {
-                                        handleField(node, fieldType);
+                                        const error = handleField({
+                                            node,
+                                            key,
+                                            parent,
+                                            path,
+                                            ancestors,
+                                        }, fieldType);
+                                        if (error) {
+                                            context.reportError(error);
+                                            return null;
+                                        }
                                     }
                                     else if (isUnionType(fieldType)) {
                                         for (const objectType of fieldType.getTypes()) {
-                                            handleField(node, objectType);
+                                            const error = handleField({
+                                                node,
+                                                key,
+                                                parent,
+                                                path,
+                                                ancestors,
+                                            }, objectType);
+                                            if (error) {
+                                                context.reportError(error);
+                                                return null;
+                                            }
                                         }
                                     }
                                     else if (isInterfaceType(fieldType)) {
                                         for (const objectType of args.schema.getImplementations(fieldType).objects) {
-                                            handleField(node, objectType);
+                                            const error = handleField({
+                                                node,
+                                                key,
+                                                parent,
+                                                path,
+                                                ancestors,
+                                            }, objectType);
+                                            if (error) {
+                                                context.reportError(error);
+                                                return null;
+                                            }
                                         }
                                     }
                                     return undefined;

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@envelop/generic-auth",
-  "version": "7.0.0",
+  "version": "8.0.0-alpha-20240806125641-9b9885ba",
   "sideEffects": false,
   "peerDependencies": {
     "@envelop/core": "^5.0.0",
     "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0"
   },
   "dependencies": {
-    "@envelop/extended-validation": "^4.0.0",
+    "@envelop/extended-validation": "4.1.0-alpha-20240806125641-9b9885ba",
     "@graphql-tools/utils": "^10.0.6",
     "tslib": "^2.5.0"
   },

package/typings/index.d.cts

@@ -1,7 +1,5 @@
-import { DirectiveNode, ExecutionArgs, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
+import { DirectiveNode, ExecutionArgs, FieldNode, GraphQLError, GraphQLField, GraphQLObjectType } from 'graphql';
 import { DefaultContext, Maybe, Plugin, PromiseOrValue } from '@envelop/core';
-export declare class UnauthenticatedError extends GraphQLError {
-}
 export type ResolveUserFn<UserType, ContextType = DefaultContext> = (context: ContextType) => PromiseOrValue<Maybe<UserType>>;
 export type ValidateUserFnParams<UserType> = {
     /** The user object. */
@@ -10,15 +8,19 @@ export type ValidateUserFnParams<UserType> = {
     fieldNode: FieldNode;
     /** The object type which has the field that is being validated. */
     objectType: GraphQLObjectType;
+    /** The object field */
+    field: GraphQLField<any, any>;
     /** The directive node used for the authentication (If using an SDL flow). */
     fieldAuthDirectiveNode: DirectiveNode | undefined;
     /** The extensions used for authentication (If using an extension based flow). */
     fieldAuthExtension: unknown | undefined;
     /** The args passed to the execution function (including operation context and variables) **/
     executionArgs: ExecutionArgs;
+    /** Resolve path */
+    path: ReadonlyArray<string | number>;
 };
-export type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | UnauthenticatedError;
-export declare const DIRECTIVE_SDL = "\n  directive @auth on FIELD_DEFINITION\n";
+export type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | GraphQLError;
+export declare const DIRECTIVE_SDL = "\n  directive @authenticated on FIELD_DEFINITION\n";
 export declare const SKIP_AUTH_DIRECTIVE_SDL = "\n  directive @skipAuth on FIELD_DEFINITION\n";
 export type GenericAuthPluginOptions<UserType extends {} = {}, ContextType = DefaultContext, CurrentUserKey extends string = 'currentUser'> = {
     /**
@@ -74,9 +76,20 @@ export type GenericAuthPluginOptions<UserType extends {} = {}, ContextType = Def
      * @default `defaultProtectSingleValidateFn`
      */
     validateUser?: ValidateUserFn<UserType>;
+    /**
+     * Reject on unauthenticated requests.
+     * @default true
+     */
+    rejectUnauthenticated?: boolean;
 });
-export declare function defaultProtectAllValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
-export declare function defaultProtectSingleValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
+export declare function createUnauthenticatedError(params?: {
+    fieldNode?: FieldNode;
+    path?: ReadonlyArray<string | number>;
+    message?: string;
+    statusCode?: number;
+}): GraphQLError;
+export declare function defaultProtectAllValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | GraphQLError;
+export declare function defaultProtectSingleValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | GraphQLError;
 export declare const useGenericAuth: <UserType extends {} = {}, ContextType extends Record<any, any> = DefaultContext, CurrentUserKey extends string = "currentUser">(options: GenericAuthPluginOptions<UserType, ContextType, CurrentUserKey>) => Plugin<{
     validateUser: ValidateUserFn<UserType>;
 } & Record<CurrentUserKey, UserType>>;

package/typings/index.d.ts

@@ -1,7 +1,5 @@
-import { DirectiveNode, ExecutionArgs, FieldNode, GraphQLError, GraphQLObjectType } from 'graphql';
+import { DirectiveNode, ExecutionArgs, FieldNode, GraphQLError, GraphQLField, GraphQLObjectType } from 'graphql';
 import { DefaultContext, Maybe, Plugin, PromiseOrValue } from '@envelop/core';
-export declare class UnauthenticatedError extends GraphQLError {
-}
 export type ResolveUserFn<UserType, ContextType = DefaultContext> = (context: ContextType) => PromiseOrValue<Maybe<UserType>>;
 export type ValidateUserFnParams<UserType> = {
     /** The user object. */
@@ -10,15 +8,19 @@ export type ValidateUserFnParams<UserType> = {
     fieldNode: FieldNode;
     /** The object type which has the field that is being validated. */
     objectType: GraphQLObjectType;
+    /** The object field */
+    field: GraphQLField<any, any>;
     /** The directive node used for the authentication (If using an SDL flow). */
     fieldAuthDirectiveNode: DirectiveNode | undefined;
     /** The extensions used for authentication (If using an extension based flow). */
     fieldAuthExtension: unknown | undefined;
     /** The args passed to the execution function (including operation context and variables) **/
     executionArgs: ExecutionArgs;
+    /** Resolve path */
+    path: ReadonlyArray<string | number>;
 };
-export type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | UnauthenticatedError;
-export declare const DIRECTIVE_SDL = "\n  directive @auth on FIELD_DEFINITION\n";
+export type ValidateUserFn<UserType> = (params: ValidateUserFnParams<UserType>) => void | GraphQLError;
+export declare const DIRECTIVE_SDL = "\n  directive @authenticated on FIELD_DEFINITION\n";
 export declare const SKIP_AUTH_DIRECTIVE_SDL = "\n  directive @skipAuth on FIELD_DEFINITION\n";
 export type GenericAuthPluginOptions<UserType extends {} = {}, ContextType = DefaultContext, CurrentUserKey extends string = 'currentUser'> = {
     /**
@@ -74,9 +76,20 @@ export type GenericAuthPluginOptions<UserType extends {} = {}, ContextType = Def
      * @default `defaultProtectSingleValidateFn`
      */
     validateUser?: ValidateUserFn<UserType>;
+    /**
+     * Reject on unauthenticated requests.
+     * @default true
+     */
+    rejectUnauthenticated?: boolean;
 });
-export declare function defaultProtectAllValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
-export declare function defaultProtectSingleValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | UnauthenticatedError;
+export declare function createUnauthenticatedError(params?: {
+    fieldNode?: FieldNode;
+    path?: ReadonlyArray<string | number>;
+    message?: string;
+    statusCode?: number;
+}): GraphQLError;
+export declare function defaultProtectAllValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | GraphQLError;
+export declare function defaultProtectSingleValidateFn<UserType>(params: ValidateUserFnParams<UserType>): void | GraphQLError;
 export declare const useGenericAuth: <UserType extends {} = {}, ContextType extends Record<any, any> = DefaultContext, CurrentUserKey extends string = "currentUser">(options: GenericAuthPluginOptions<UserType, ContextType, CurrentUserKey>) => Plugin<{
     validateUser: ValidateUserFn<UserType>;
 } & Record<CurrentUserKey, UserType>>;