graphql-python / graphql-python/graphene-sqlalchemy

Question: How do you recommend enforcing authorization?

未关闭
#186 5 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
Python
星标
985
派生
223
PR 合并指标
30 天内没有已合并 PR

描述

Hello,

I'd like to systematically enforce authorization for nodes and individual fields within the nodes.

Conceptually something like this might work:

```python
class MyNode(AuthZSQLAlchemyObjectType):
class Meta:
model = MyModel
authorize_node_function = node_authorizer
field_auth = dict(
"name": all_authorizer,
"private_things": self_only_authorizer,
)
```

`node_authorizer(model_instance)` would get called whenever a new Node of that type is created. Only fields in the field_auth dict would be exposed in node, and then the associated function would be called like `resolve_authorizer(model_instance, field_name)`

Any opinions on the best way to achieve this?

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。