ChilliCream / ChilliCream/graphql-platform

Support "BeforeResolver" authorization on subscriptions

Open
#6,259 3 comments 4 reactions 1 assignee View on GitHub

@michaelstaib is already working on this.

Since Sep 24, 2024.

🌶️ hot chocolate Area: Authorization
Dominant language
C#
Stars
5.8k
Forks
810
Avg merge
15h 39m
Merged PRs (30d)
98

Description

Product

Hot Chocolate

Is your feature request related to a problem?

We would like to be able to enforce authorization on subscriptions, when the client is subscribing to the subscription endpoint. We would also like to use the arguments from the subscription request to make authorization decisions.
Currently, when using Authorize attribute with ApplyPolicy.BeforeResolver on subscriptions, the authorization policy doesn't get invoked on-subscribe. If we use ApplyPolicy.Validation , the authorization policy would be invoked on-subscribe. But, in that case, we don't have full context of the arguments within the authorization handler, as the authorization resource is AuthorizationContext (as opposed to IResolverContext), which contains DocumentNode and no way to access the arguments.
In the example below, I'd like to use bookId in my AspNet authorization handler, to make authorization decision.

[SubscriptionType]
public class Subscriptions
{
    [Subscribe]
    [HotChocolate.Authorization.Authorize("MyPolicy", ApplyPolicy.BeforeResolver)] // <--- Authorization policy doesn't get invoked when "BeforeResolver" is used
    public Book BookUpdated(int bookId, [EventMessage] Book book) => book;
}

The solution you'd like

Support "BeforeResolver" authorization on subscriptions, so that authorization handler can access IResolverContext, and by extension, graphql arguments, to make authorization decisions.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.