GraphQL permissions documentation

Question

How do you document that some collections can be accessed or changed only by user which has same permissions/roles, for example only authenticated users can write a comment?

Answer 1

As of graphql-java v4.0, it is possible to easily filter the schema for operation visibility. This way, you present a different schema to each user, based on their access rights, and the user only gets to see the operations they can actually perform. So the whole thing becomes beautifully self-documenting.

It would look something like:

//create an implementation that limits certain operations based on their name
//you can also provide a completely custom implementation
GraphqlFieldVisibility blockedFields = BlockedFields.newBlock()
                .addPattern("Character.id")
                .addPattern("Droid.appearsIn")
                .addPattern(".*\\.hero") // it uses regular expressions
                .build();

//create a role-specific schema based on the global one
GraphQLSchema schema = GraphQLSchema.newSchema(globalSchema)
                .fieldVisibility(blockedFields) //apply restrictions for this user
                .build();

Creating a new schema from an existing is a very cheap operation. You can then keep the user/role specific schema in the session, for example. It is not a big deal to even recreate one on each request.

Answer 2

Its instructive to see data in graphql as fundamentally dependent on a viewer.

Establish a logged in user on your back end and then render the front end code as a function of the current user.

So, in your graphql resolver you would fetch data associated with that user and one of the fields could be the user's permissions. Then, you pass the relevant props to your front end framework and render whatever is relevant to that person. In your specified case, you would perhaps omit rendering a comment box if the user lacks a certain level of authentication.