graphql-python / graphql-python/graphene-sqlalchemy

Question: How do you recommend enforcing authorization?

Abierto
#186 5 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
Python
Estrellas
985
Forks
223
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

Hello,

I'd like to systematically enforce authorization for nodes and individual fields within the nodes.

Conceptually something like this might work:

```python
class MyNode(AuthZSQLAlchemyObjectType):
class Meta:
model = MyModel
authorize_node_function = node_authorizer
field_auth = dict(
"name": all_authorizer,
"private_things": self_only_authorizer,
)
```

`node_authorizer(model_instance)` would get called whenever a new Node of that type is created. Only fields in the field_auth dict would be exposed in node, and then the associated function would be called like `resolve_authorizer(model_instance, field_name)`

Any opinions on the best way to achieve this?

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.