https://github.com/officialpycasbin/graphql-authz
GraphQL authorization middleware based on PyCasbin
https://github.com/officialpycasbin/graphql-authz
abac acl auth authorization authz casbin graphql middleware pycasbin python rbac
Last synced: 5 months ago
JSON representation
GraphQL authorization middleware based on PyCasbin
- Host: GitHub
- URL: https://github.com/officialpycasbin/graphql-authz
- Owner: officialpycasbin
- License: apache-2.0
- Created: 2024-11-12T00:43:24.000Z (over 1 year ago)
- Default Branch: master
- Last Pushed: 2025-08-20T17:41:18.000Z (10 months ago)
- Last Synced: 2025-09-27T10:02:07.453Z (9 months ago)
- Topics: abac, acl, auth, authorization, authz, casbin, graphql, middleware, pycasbin, python, rbac
- Language: Python
- Homepage: https://github.com/casbin/pycasbin
- Size: 22.5 KB
- Stars: 0
- Watchers: 1
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
# graphql-authz
[](https://github.com/officialpycasbin/graphql-authz/actions/workflows/build.yml)
[](https://coveralls.io/github/officialpycasbin/graphql-authz)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://discord.gg/S5UjpzGZjN)
GraphQL-Authz is a Python port of [GraphQL-Authz](https://github.com/node-casbin/graphql-authz), the [Casbin](https://casbin.org/) authorization middleware implementation in [Node.js](https://nodejs.org/en/).
This package should be used with [GraphQL-core 3](https://github.com/graphql-python/graphql-core), providing the
capability to limit access to each GraphQL resource with the authorization middleware.
## Installation
Install the package using pip.
```shell
pip install casbin-graphql-authz
```
Get Started
--------
Limit the access to each GraphQL resource with a policy. For example,
given this policy for an [RBAC](https://casbin.org/docs/rbac/) model:
```csv
p, authorized_user, hello, query
```
Authorization can be enforced using:
```python3
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
authorization_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[authorization_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[authorization_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
```
For more interesting scenarios see `tests` folder.
## Credits
Implementation was heavily inspired by the [Node.js](https://nodejs.org/en/) middleware [GraphQL-Authz](https://github.com/node-casbin/graphql-authz).
Authorization enforcement is based on [Casbin](https://casbin.org/) authorization library.