MichalLytek / MichalLytek/type-graphql

Field authorization defined in the Input Type field

Open
#1,723 1 comment 1 reaction 0 assignees View on GitHub
Community :family_man_girl: Enhancement :new:
Dominant language
TypeScript
Stars
8.1k
Forks
672
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
I would like to have a per field authorization on inputs, so users with the specific role can update some fields, and other users with different role can't.

**Describe the solution you'd like**

The ideal solution would be to have a possibility to mark certain fields in Input Type to require the authorization.
```
@InputType()
class UpdateUserInput {
@Field()
@Authorized(['ADMIN', 'CUSTOMER'])
fullName: string;

@Field()
@Authorized('ADMIN')
email: string;
}
```

If the user has a role `'ADMIN'` and he tries to fire update mutation using `UpdateUserInput`, specifing `email` field
then the authorization should pass an access to this update mutation.

If the user has a role `'CUSTOMER'` and he tries to fire update mutation using `UpdateUserInput`, specifing `email` field
then the authorization should block the user from performing this operation.

**Describe alternatives you've considered**
I considered creating different mutation resolvers for different roles.
The disadvantages of this approach are:
* significant amount of duplicated code
* it's hard to automize it with crud generators
* it looks like mixing methods to do one thing, since`@Authorized` decorator is available for fields in Object Types

---
Please let me know what you think.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Review the existing @Authorized behavior on Object Type fields alongside InputType handling, then determine how per-field role checks should apply during update mutations. Done should mean that the roles shown in the examples can update only the permitted input fields.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api, authorization, backend-api-design
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.