https://github.com/node-casbin/graphql-authz
graphql-authz is a Casbin authorization middleware for GraphQL.js
https://github.com/node-casbin/graphql-authz
abac acl auth authorization authz casbin graph-js graphql middleware plugin rbac
Last synced: 3 months ago
JSON representation
graphql-authz is a Casbin authorization middleware for GraphQL.js
- Host: GitHub
- URL: https://github.com/node-casbin/graphql-authz
- Owner: node-casbin
- License: apache-2.0
- Created: 2021-07-05T17:48:20.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2021-07-21T07:33:08.000Z (about 4 years ago)
- Last Synced: 2024-10-29T01:14:24.960Z (11 months ago)
- Topics: abac, acl, auth, authorization, authz, casbin, graph-js, graphql, middleware, plugin, rbac
- Language: TypeScript
- Homepage: https://github.com/casbin/node-casbin
- Size: 98.6 KB
- Stars: 12
- Watchers: 3
- Forks: 4
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# graphql-authz
graphql-authz is a Casbin authorization middleware for [GraphQL.js](https://github.com/graphql/graphql-js)
[![NPM version][npm-image]][npm-url]
[![NPM download][download-image]][download-url]
[](https://packagephobia.now.sh/result?p=graphql-authz)
[](https://github.com/node-casbin/graphql-authz/actions)
[](https://coveralls.io/github/node-casbin/graphql-authz?branch=master)
[](https://github.com/node-casbin/graphql-authz/releases/latest)
[](https://gitter.im/casbin/lobby)
[npm-image]: https://img.shields.io/npm/v/graphql-authz.svg?style=flat-square
[npm-url]: https://npmjs.org/package/graphql-authz
[download-image]: https://img.shields.io/npm/dm/graphql-authz.svg?style=flat-square
[download-url]: https://npmjs.org/package/graphql-authz
## Installation
```shell
npm install graphql-authz
// or
yarn add graphql-authz
```
## Get Started
This package should use with `graphql` and `graphql-middleware`
To limit access to each endpoint, you can use casbin policy or graphql directive.
In the policy method, you can use casbin policy like
```csv
p,user,project.members,query
p,roleb,project.members.tickets.id,query
```
to restricted access to each endpoint.
In the directive method, you can use directive `can` to do the same thing.
Here's a minimal example. You can find the full example in the `tests/server.test.ts`
```typescript
import { applyMiddleware } from 'graphql-middleware';
import { newMiddleware, CanDirective } from 'graphql-authz';
import { newEnforcer } from 'casbin';
import { ApolloServer } from 'apollo-server';
import { makeExecutableSchema } from '@graphql-tools/schema';
import { CasbinContextEnforcerKey } from '../src';
// After graphql-js 14.0.0, you should manually define directive in the SDL.
const typeDefs = `
directive @can(who: String!) on FIELD_DEFINITION
type User {
id: ID! @can(who: "user")
name: String @can(who: "someone")
}
`;
const resolvers = {
// something
};
const schemaWithDirective = makeExecutableSchema({
typeDefs,
resolvers,
schemaDirectives: {
can: CanDirective,
},
});
// If you want to use directive, this is necessary.
// You can ignore this in the policy only method.
const enforcer = await newEnforcer('tests/casbin.conf', 'tests/policy.csv');
// As for now, you should use model tests/casbin.conf to initialize enforcer.
// For more info about enforcer, plz refer to https://github.com/casbin/node-casbin
const middleware = await newMiddleware({
ctxMember: 'user', // middleware will get current user role from the graphql context[ctxMember]
enforcer: enforcer, // Casbin Instance
});
// Apply middlware to graphql schema
const schemaWithDirectiveMiddleware = applyMiddleware(schemaWithDirective, middleware);
const server = new ApolloServer({
schema: schemaWithDirectiveMiddleware,
context: ({ req }) => {
// Provide necessary info in the context.
const token = req.headers.authorization || '';
// Try to retrieve a user with the token
const user = getUser(token);
const a: any = {};
a[CasbinContextEnforcerKey] = enforcer;
a['user'] = user;
return a;
},
});
```
## Getting Help
- [Node-Casbin](https://github.com/casbin/node-casbin)
## License
This project is under Apache 2.0 License. See the [LICENSE](LICENSE) file for the full license text.