https://github.com/pycasbin/graphql-authz
graphql-authz is an casbin authorization middleware for GraphQL
https://github.com/pycasbin/graphql-authz
abac acl auth authorization casbin graphql pycasbin python rbac
Last synced: 10 days ago
JSON representation
graphql-authz is an casbin authorization middleware for GraphQL
- Host: GitHub
- URL: https://github.com/pycasbin/graphql-authz
- Owner: pycasbin
- License: apache-2.0
- Created: 2023-08-03T08:50:05.000Z (almost 3 years ago)
- Default Branch: master
- Last Pushed: 2024-03-29T13:32:33.000Z (about 2 years ago)
- Last Synced: 2025-03-25T10:01:48.727Z (about 1 year ago)
- Topics: abac, acl, auth, authorization, casbin, graphql, pycasbin, python, rbac
- Language: Python
- Homepage: https://github.com/casbin/pycasbin
- Size: 15.6 KB
- Stars: 1
- Watchers: 2
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
# graphql-authz
[](https://github.com/pycasbin/graphql-authz/actions/workflows/build.yml)
[](https://coveralls.io/github/pycasbin/graphql-authz)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://pypi.org/project/casbin-graphql-authz/)
[](https://discord.gg/S5UjpzGZjN)
GraphQL-Authz is a Python port of [GraphQL-Authz](https://github.com/node-casbin/graphql-authz), the [Casbin](https://casbin.org/) authorization middleware implementation in [Node.js](https://nodejs.org/en/).
This package should be used with [GraphQL-core 3](https://github.com/graphql-python/graphql-core), providing the
capability to limit access to each GraphQL resource with the authorization middleware.
## Installation
Install the package using pip.
```shell
pip install casbin-graphql-authz
```
Get Started
--------
Limit the access to each GraphQL resource with a policy. For example,
given this policy for an [RBAC](https://casbin.org/docs/rbac/) model:
```csv
p, authorized_user, hello, query
```
Authorization can be enforced using:
```python3
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
authorization_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[authorization_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[authorization_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
```
For more interesting scenarios see `tests` folder.
## Credits
Implementation was heavily inspired by the [Node.js](https://nodejs.org/en/) middleware [GraphQL-Authz](https://github.com/node-casbin/graphql-authz).
Authorization enforcement is based on [Casbin](https://casbin.org/) authorization library.