MichalLytek / MichalLytek/type-graphql
Field authorization defined in the Input Type field
- Dominant language
- TypeScript
- Stars
- 8.1k
- Forks
- 672
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
I would like to have a per field authorization on inputs, so users with the specific role can update some fields, and other users with different role can't.
**Describe the solution you'd like**
The ideal solution would be to have a possibility to mark certain fields in Input Type to require the authorization.
```
@InputType()
class UpdateUserInput {
@Field()
@Authorized(['ADMIN', 'CUSTOMER'])
fullName: string;
@Field()
@Authorized('ADMIN')
email: string;
}
```
If the user has a role `'ADMIN'` and he tries to fire update mutation using `UpdateUserInput`, specifing `email` field
then the authorization should pass an access to this update mutation.
If the user has a role `'CUSTOMER'` and he tries to fire update mutation using `UpdateUserInput`, specifing `email` field
then the authorization should block the user from performing this operation.
**Describe alternatives you've considered**
I considered creating different mutation resolvers for different roles.
The disadvantages of this approach are:
* significant amount of duplicated code
* it's hard to automize it with crud generators
* it looks like mixing methods to do one thing, since`@Authorized` decorator is available for fields in Object Types
---
Please let me know what you think.
Contributor guide
Research direction
No files, tests, or entry points are named. Review the existing @Authorized behavior on Object Type fields alongside InputType handling, then determine how per-field role checks should apply during update mutations. Done should mean that the roles shown in the examples can update only the permitted input fields.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, typescript
- Domain
- api, authorization, backend-api-design
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100