graphql-python / graphql-python/graphene-sqlalchemy

Question: How do you recommend enforcing authorization?

Offen
#186 5 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
question
Vorherrschende Sprache
Python
Sterne
985
Forks
223
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

Hello,

I'd like to systematically enforce authorization for nodes and individual fields within the nodes.

Conceptually something like this might work:

```python
class MyNode(AuthZSQLAlchemyObjectType):
class Meta:
model = MyModel
authorize_node_function = node_authorizer
field_auth = dict(
"name": all_authorizer,
"private_things": self_only_authorizer,
)
```

`node_authorizer(model_instance)` would get called whenever a new Node of that type is created. Only fields in the field_auth dict would be exposed in node, and then the associated function would be called like `resolve_authorizer(model_instance, field_name)`

Any opinions on the best way to achieve this?

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.