ChilliCream / ChilliCream/graphql-platform
Support "BeforeResolver" authorization on subscriptions
@michaelstaib is already working on this.
Since Sep 24, 2024.
- Dominant language
- C#
- Stars
- 5.8k
- Forks
- 810
- Avg merge
- 15h 39m
- Merged PRs (30d)
- 98
Description
Product
Hot Chocolate
Is your feature request related to a problem?
We would like to be able to enforce authorization on subscriptions, when the client is subscribing to the subscription endpoint. We would also like to use the arguments from the subscription request to make authorization decisions.
Currently, when using Authorize attribute with ApplyPolicy.BeforeResolver on subscriptions, the authorization policy doesn't get invoked on-subscribe. If we use ApplyPolicy.Validation , the authorization policy would be invoked on-subscribe. But, in that case, we don't have full context of the arguments within the authorization handler, as the authorization resource is AuthorizationContext (as opposed to IResolverContext), which contains DocumentNode and no way to access the arguments.
In the example below, I'd like to use bookId in my AspNet authorization handler, to make authorization decision.
[SubscriptionType]
public class Subscriptions
{
[Subscribe]
[HotChocolate.Authorization.Authorize("MyPolicy", ApplyPolicy.BeforeResolver)] // <--- Authorization policy doesn't get invoked when "BeforeResolver" is used
public Book BookUpdated(int bookId, [EventMessage] Book book) => book;
}
The solution you'd like
Support "BeforeResolver" authorization on subscriptions, so that authorization handler can access IResolverContext, and by extension, graphql arguments, to make authorization decisions.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.