graphql-python / graphql-python/graphene-sqlalchemy

Question: How do you recommend enforcing authorization?

Open
#186 5 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Python
Stars
985
Forks
223
PR merge metrics
No merged PRs in 30d

Description

Hello,

I'd like to systematically enforce authorization for nodes and individual fields within the nodes.

Conceptually something like this might work:

```python
class MyNode(AuthZSQLAlchemyObjectType):
class Meta:
model = MyModel
authorize_node_function = node_authorizer
field_auth = dict(
"name": all_authorizer,
"private_things": self_only_authorizer,
)
```

`node_authorizer(model_instance)` would get called whenever a new Node of that type is created. Only fields in the field_auth dict would be exposed in node, and then the associated function would be called like `resolve_authorizer(model_instance, field_name)`

Any opinions on the best way to achieve this?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.