spring-projects / spring-projects/spring-graphql
How to make `GraphqlFieldVisibility` work with WebFlux
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.6k
- Forks
- 336
- PR merge metrics
- No merged PRs in 30d
Description
spring-boot 2.7.0-M1
spring-boot-starter-graphql 2.7.0-M1
@Bean
public RuntimeWiringConfigurer configurer(MyReactiveUserAccessService myReactiveUserAccessService) {
return (builder) -> builder.fieldVisibility(new PerFieldAuthorization(myReactiveUserAccessService));
}
class PerFieldAuthorization implements GraphqlFieldVisibility {
private final MyReactiveUserAccessService myReactiveUserAccessService;
public PerFieldAuthorization(MyReactiveUserAccessService myReactiveUserAccessService) {
this.myReactiveUserAccessService = myReactiveUserAccessService;
}
@Override
public List<GraphQLFieldDefinition> getFieldDefinitions(GraphQLFieldsContainer fieldsContainer) {
return fieldsContainer.getFieldDefinitions();
}
@Override
public GraphQLFieldDefinition getFieldDefinition(GraphQLFieldsContainer fieldsContainer, String fieldName) {
myReactiveUserAccessService.getRoles().blockLast(); // Exception
return fieldsContainer.getFieldDefinition(fieldName);
}
@Override
public List<GraphQLInputObjectField> getFieldDefinitions(GraphQLInputFieldsContainer fieldsContainer) {
return fieldsContainer.getFieldDefinitions();
}
@Override
public GraphQLInputObjectField getFieldDefinition(GraphQLInputFieldsContainer fieldsContainer, String fieldName) {
return fieldsContainer.getFieldDefinition(fieldName);
}
}
@Component
class MyReactiveUserAccessService {
public Flux<String> getRoles() {
// Mono.deferContextual((contextView) -> {
// return Mono.empty();
// });
return Flux.just("ROLE_USER", "ROLE_ADMIN");
}
}
I am trying to use GraphqlFieldVisibility (field-visibility document is here) to perform per-field authorization. Is there a way to make GraphqlFieldVisibility work with WebFlux?
Thanks.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the RuntimeWiringConfigurer and GraphqlFieldVisibility integration in the WebFlux path, using the supplied Spring Boot 2.7.0-M1 example as the reproduction case. Trace how the reactive user access service reaches the field-visibility callbacks, then establish whether a supported reactive authorization path can be provided or the limitation should be documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- api, authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100