@envelop/operation-field-permissions 3.4.0-alpha-26c4ae2.0 → 3.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +65 -0
- package/package.json +3 -3
package/README.md
ADDED
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
## `@envelop/operation-field-permissions`
|
|
2
|
+
|
|
3
|
+
Disallow executing operations that select certain fields. Useful if you want to restrict the scope of certain public API users to a subset of the public GraphQL schema, without triggering execution (e.g. how [graphql-shield](https://github.com/maticzav/graphql-shield) works).
|
|
4
|
+
|
|
5
|
+
**Note:** This plugin and authorization on a resolver level (or via middleware) are complementary. You should still verify whether a viewer is allowed to access certain data within your resolvers.
|
|
6
|
+
|
|
7
|
+
## Installation
|
|
8
|
+
|
|
9
|
+
```bash
|
|
10
|
+
yarn add @envelop/operation-field-permissions
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
## Usage Example
|
|
14
|
+
|
|
15
|
+
```ts
|
|
16
|
+
import { envelop, useSchema } from '@envelop/core';
|
|
17
|
+
import { useOperationFieldPermissions } from 'envelop/operation-field-permissions';
|
|
18
|
+
|
|
19
|
+
const getEnveloped = envelop({
|
|
20
|
+
plugins: [
|
|
21
|
+
useSchema(schema),
|
|
22
|
+
useOperationFieldPermissions({
|
|
23
|
+
// we can access graphql context here
|
|
24
|
+
getPermissions: async context => new Set(['Query.greetings', ...context.viewer.permissions]),
|
|
25
|
+
}),
|
|
26
|
+
/* ... other envelops */
|
|
27
|
+
],
|
|
28
|
+
});
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
**Schema**
|
|
32
|
+
|
|
33
|
+
```graphql
|
|
34
|
+
type Query {
|
|
35
|
+
greetings: [String!]!
|
|
36
|
+
foo: String
|
|
37
|
+
}
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
**Operation**
|
|
41
|
+
|
|
42
|
+
```graphql
|
|
43
|
+
query {
|
|
44
|
+
foo
|
|
45
|
+
}
|
|
46
|
+
```
|
|
47
|
+
|
|
48
|
+
**Response**
|
|
49
|
+
|
|
50
|
+
```json
|
|
51
|
+
{
|
|
52
|
+
"data": null,
|
|
53
|
+
"errors": [
|
|
54
|
+
{
|
|
55
|
+
"message": "Insufficient permissions for selecting 'Query.foo'.",
|
|
56
|
+
"locations": [
|
|
57
|
+
{
|
|
58
|
+
"line": 2,
|
|
59
|
+
"column": 2
|
|
60
|
+
}
|
|
61
|
+
]
|
|
62
|
+
}
|
|
63
|
+
]
|
|
64
|
+
}
|
|
65
|
+
```
|
package/package.json
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@envelop/operation-field-permissions",
|
|
3
|
-
"version": "3.4.0
|
|
3
|
+
"version": "3.4.0",
|
|
4
4
|
"sideEffects": false,
|
|
5
5
|
"peerDependencies": {
|
|
6
|
-
"@envelop/core": "2.4.0
|
|
6
|
+
"@envelop/core": "^2.4.0",
|
|
7
7
|
"graphql": "^14.0.0 || ^15.0.0 || ^16.0.0"
|
|
8
8
|
},
|
|
9
9
|
"dependencies": {
|
|
10
|
-
"@envelop/extended-validation": "1.7.0
|
|
10
|
+
"@envelop/extended-validation": "^1.7.0"
|
|
11
11
|
},
|
|
12
12
|
"repository": {
|
|
13
13
|
"type": "git",
|