graphql-python / graphql-python/graphene-django

Permission System

Open
#79 56 comments 34 reactions 0 assignees View on GitHub
✨enhancement
Dominant language
Python
Stars
4.4k
Forks
760
PR merge metrics
No merged PRs in 30d

Description

I would like to add a permission system but want to some feedback on the API before I implement.

You would have two options and I'm proposing to add both:

## Option 1: Custom queryset method

This option would let you overwrite how a queryset is filtered.

```python
class UserNode(DjangoObjectType):
class Meta:
model = User
interfaces = (relay.Node,)
only_fields = ('email', 'first_name', 'last_name')

@classmethod
def get_queryset (cls, queryset, args, request, info):
return queryset.filter(owner=request.user)
```

## Option 2: Permissions List

This option would setup a Meta API to use to define permissions

```python
def auth_required(queryset, args, request, info):
if request.user.is_authenticated():
return queryset

return queryset.none()

class UserNode(DjangoObjectType):
class Meta:
model = User
interfaces = (relay.Node,)
only_fields = ('email', 'first_name', 'last_name')
permissions = [auth_required]
```

If these look like good APIs then I'll implement.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.