Schema Based Field Level Authorization with Spring Framework

[git-addict]

Hi Everyone,

Really excited to see a community here around graphQL. I am newbie and wondering how we can achieve attribute level authorization using graphql Java just like elaborated in this example here (https://blog.grandstack.io/authorization-in-graphql-using-custom-schema-directives-eafa6f5b4658) . It is just that I am not able to find any Java/Spring based example. Will a similar approach work for Java graphQL spring based project.

[jord1e]

You are not telling us much about your tech-stack.

Are you using a framework (like DGS Framework, Spring for GraphQL, or graphql-java-tools)?

The best way to achieve this would probably be to inject your Authentication context into the GraphQLContext and access it via a wrapped datafetcher in your SchemaDirectiveWiring:
https://www.graphql-java.com/documentation/sdl-directives#another-example---date-formatting

You would edit the wrapping datafetcher:

       DataFetcher dataFetcher = DataFetcherFactories.wrapDataFetcher(originalFetcher, ((dataFetchingEnvironment, value) -> {
            // Do Auth, throw error or return Try<YourType>
            return value;
        }));

and return field instead of apply #transform to it.