RFC - @auth directive improvements
# RFC - @auth directive improvements This document will outline designs for a number of new features relating to authentication & authorization within the GraphQL Transform. The goal of these features is too fill holes and introduce new mechanisms that make protecting your valuable information easier. # Proposal 1: Replace 'queries' and 'mutations' arguments with 'operations' > Merged by aws-amplify/amplify-cli#1262 Currently an @auth directive like this: ```graphql type Task @model @auth(rules: [{allow: owner}]) { id: ID! title: String owner: String } ``` causes these changes to the following resolvers: 1. *Query.getTask* - Returns the post only if the logged in user is the post's owner. 2. *Query.listTasks* - Filter items such that only owned posts are returned. 3. *Mutation.createTask* - If an owner is provided via $ctx.args.input.owner and matches the identity of the logged in user, succeed. If no owner is provided, set logged in user as the owner, else fail. 4. *Mutation.updateTask* - Append a conditional expression that will only update the record if the logged in user is its owner. 5. *Mutation.deleteTask* - Append a conditional expression that will only delete the record if the logged in user is its owner. In other words, the @auth directive currently protects the root level query & mutation fields that are generated for an @model type. ### Problem: The 'queries' and 'mutations' arguments imply top level protection GraphQL APIs are a graph and we
Posted by mikeparisstuff on Mar 14, 2019, 10:16 PM
Tags
Related issues
- The issue is really the extreme difficulty of programming them, especially for anything sequential (rather than combinatorial).
- I probably could have beared with it if it was only limited to programming, but it showing up in creative fields has made me feel all sor...
- I hate that I'm in deep enough to know what you mean.
- The biggest problem with “AI” is that big corps are shoving it down our throats.
- in the middel of a coding session with 5.6 sol.
- [Hero Run] 535B-A23B on 18T tokens
Raise real-world problems, find people facing the same issue, and discuss solutions.4,000 issues0 comments
reliability (Other)
The issue is really the extreme difficulty of programming them, especially for anything sequential (rather than combinatorial).
I probably could have beared with it if it was only limited to programming, but it showing up in creative fields has made me feel all sor...
I hate that I'm in deep enough to know what you mean.
The biggest problem with “AI” is that big corps are shoving it down our throats.
in the middel of a coding session with 5.6 sol.
[Hero Run] 535B-A23B on 18T tokens
I hate that this is how AI is being used..
inexperienced protobuf user here -- why do non-googlers generally use protobuf?
RFC - @auth directive improvements
# RFC - @auth directive improvements This document will outline designs for a number of new features relating to authentication & authorization within the GraphQL Transform. The goal of these features is too fill holes and introduce new mechanisms that make protecting your valuable information easier. # Proposal 1: Replace 'queries' and 'mutations' arguments with 'operations' > Merged by aws-amplify/amplify-cli#1262 Currently an @auth directive like this: ```graphql type Task @model @auth(rules: [{allow: owner}]) { id: ID! title: String owner: String } ``` causes these changes to the following resolvers: 1. *Query.getTask* - Returns the post only if the logged in user is the post's owner. 2. *Query.listTasks* - Filter items such that only owned posts are returned. 3. *Mutation.createTask* - If an owner is provided via $ctx.args.input.owner and matches the identity of the logged in user, succeed. If no owner is provided, set logged in user as the owner, else fail. 4. *Mutation.updateTask* - Append a conditional expression that will only update the record if the logged in user is its owner. 5. *Mutation.deleteTask* - Append a conditional expression that will only delete the record if the logged in user is its owner. In other words, the @auth directive currently protects the root level query & mutation fields that are generated for an @model type. ### Problem: The 'queries' and 'mutations' arguments imply top level protection GraphQL APIs are a graph and we
Comments (0)
No comments yet. Start the discussion.