graphql-directive-auth
Introduction
The graphql-directive-auth
was created to help with common authentication tasks that is faced in almost every API.
Table of Contents
- graphql-directive-auth
- Introduction
- Table of Contents
- Installation
- Usage
- Directive Parameters
- LICENSE
Installation
yarn add graphql-directive-auth
Usage
We are able to use directives in two different way:
Default
To use the default directive behaviour, you need to set APP_SECRET
environment variable, and that's all.
default
means, and what do I need to do?
What @isAuthenticated
- Just after you set environment variables, you need to have a valid JWT token and send it byAuthorization
in the HTTP headers. That's all, the directive will check your token and throw an error if the token is invalid or expired.@hasRole
- Checks roles of an authenticated user. To use it correctly, inside your JWT token you should have therole
property with the correct role. If the user role doesn't match with the provided role, then directive will throw an error.
@hasRole
before checking role is doing authentication to get roles from JWT token.
Example:
;// orconst AuthDirective = AuthDirective; // set environment variable, but in better way ;)processenvAPP_SECRET = 'your_secret_key'; const schema = ;
Custom behaviour of authentication functions
If you need custom Authentication you can pass your authentication function to the main AuthDirective
functions. Your authentication function should return an object which will be available via context.auth
.
Authentication function signature:
{ // your logic here // you should return an object // this object will be passed inside your resolver // it is available inside context via auth property return user: id: 'your_user_id' ;};
usage:
;// orconst AuthDirectives = AuthDirective; const customAuth = ; const schema =
resolver:
Query: root args ctx const userId = ctxauthuserid; // your_user_id ;
Custom check role function
Same as with the authenticate function, you can add your own logic to checking roles.
How to create your own function
- Function accepts two parameters, one is the context and the second is the value from the directive
- To reject an access to the particular field, you need to throw an Error that will be caught by the directive and returned if required.
- Function doesn't need to return anything special
Directive Parameters
- '@isAuthenticated' - checks if user is authenticated
- '@hasRole(role: "user, admin")' - checks if user is authenticated and has the specified roles
if you use
graphql-import
then you need to add this definition on top of the schema:
directive @isAuthenticated on FIELD | FIELD_DEFINITIONdirective @hasRole(role: String) on FIELD | FIELD_DEFINITION
Contributing
I would love to see your contribution. ❤️
For local development (and testing), all you have to do is to run yarn
and then yarn dev
. This will start the Apollo server and you are ready to contribute 🎉
Run yarn test (try --watch
flag) for unit tests (we are using Jest)
LICENSE
The MIT License (MIT) 2018 - Luke Czyszczonik - mailto:lukasz.czyszczonik@gmail.com