Authorization in the GraphQL era

AUTH
IN
THE
GraphQL
ERA

View Slide

View Slide

Don't talk with me,
I'm a picture!

View Slide

View Slide

evilmartians.com

View Slide

TATARSTAN

View Slide

Authorization
90 %
GraphQL
10 %
Buzzwords  
of  
GraphQL
100 %
How do I see my talk What do people expect

View Slide

https://book.productionreadygraphql.com/

View Slide

GraphQL Auth
through the prism of
RESTful Auth

View Slide

Standard Rails App
DB
UsersController
PostsController
GET /users
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
...
BUSINESS LOGIC LAYER

View Slide

Standard Rails App
DB
UsersController
PostsController
GET /users
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
...
User

View Slide

Standard Rails App
DB
UsersController
PostsController
GET /users
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
...
Data

View Slide

Standard Rails App
DB
UsersController
PostsController
GET /users
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
...
RESTFul

View Slide

Rails DHH way
it's me

View Slide

Standard* Rails App
DB
UsersController
PostsController
GET /users
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
...
*ACCESS
CONTROL 
LAYER
RESTFul

View Slide

REST\RESTfull is a
software architectural style
that deﬁnes a set of constraints to be used
for creating web services
(c) Wikipedia

View Slide

GraphQL is a query language for APIs
and a runtime for fulﬁlling those
queries with your existing data.

View Slide

DB
GraphqlController
POST /graphql
GraphQL Rails App
GRAPHQL INTERNALS

View Slide

DB
GraphqlController
POST /graphql
GraphQL Rails App
GRAPHQL INTERNALS
User
Data

View Slide

DB
GraphqlController
POST /graphql
GraphQL Rails App
GRAPHQL INTERNALS
???

View Slide

GraphqlControll#execute
class GraphqlControll < ApplicationController!::Base
def execute
query = params[:query]
result = AppSchema.execute(query, params: params)
render json: result
end
end

View Slide

GraphQL Internals

View Slide

AppSchema#execute(q, p)
GraphQL Internals
GraphqlController
POST /graphql

View Slide

Types--
Mutations--
GraphQL Internals
GraphqlController
POST /graphql
*R**
C*UD

View Slide

GraphQL Internals
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
UpdateProﬁleMutation
GraphqlController

View Slide

When You Read
First Pages of
GraphQL
Documentation

View Slide

*ACCESS
CONTROL 
LAYER
DB
GraphqlController
POST /graphql
GraphQL* Rails App
GRAPHQL ENGINE

View Slide

Authentication before
authorization

View Slide

Authentication
WHO
IS WHO? Homer#0 Homer#1
Homer#2
Homer#3

View Slide

Authentication
Auth Framework
User Model
Crypto Layer
Helpers (e.g. emails)
...
(e.g. devise)
GraphQL
RESTfull
? How to use Framework ?

View Slide

AppSchema#execute
Login\Logout?
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
LoginUser
LogoutUser
GraphqlController

View Slide

AppSchema#execute
Login\Logout?
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
LoginUser
LogoutUser
GraphqlController
# NOT NECESSARY

View Slide

AppSchema#execute
Login\Logout?
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController
GOOD
[DeviseControllers]

View Slide

def execute
context = {current_user: get_user_from_api_token}
result = AppSchema.execute(query, context: context)
render json: result
end
end

View Slide

UsersController
PostsController
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
*ACCESS
CONTROL 
LAYER
GET /users
Ensuring Authentication

View Slide

before_action :authenticate_user!
UsersController
PostsController
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
*ACCESS
CONTROL 
LAYER
GET /users

View Slide

AppSchema#execute
The One Entrypoint
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController

View Slide

Welcome graphql-ruby!
⭐ 4.1k on Github

View Slide

def execute
context = {current_user: get_user_from_api_token}
result = AppSchema.execute(query, context: context)
render json: result
end
end
* context - state passed through the entire request

View Slide

GraphQL Internals
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController

View Slide

class UserType < BaseType
field :profile, ProfileType
def profile
user.profile
end
end
UserType !-> ProﬁleType
class ProfileType < BaseType
field :full_name
!!...
end

View Slide

def profile
raise NotAuthorized unless context[:current_user]&.is_a?(User)
user.profile
end
end

View Slide

def profile
user.profile
end
end
Maintainability

View Slide

We Need
Some Magic!

View Slide

def profile
user.profile
end
def visible?(context)
end
end
Visibility
* visibility - special graphql-ruby feature

View Slide

module Extensions
module Visibility
return context[:current_user]&.is_a?(User)
super
end
end
end
BaseType.prepend(Extensions!::Visibility)
Visibility Extension

View Slide

module Extensions
module Visibility
return context[:current_user]&.is_a?(User)
super
end
end
end
BaseType.prepend(Extensions!::Visibility)
Global

View Slide

module Extensions
module Visibility
def initialize(*args, login_required: false, !**kwargs, &block)
super(*args, !**kwargs, &block)
@login_required = login_required
end
return context[:current_user]&.is_a?(User) if @login_required
super
end
end
end

View Slide

field :posts, PostType.connection_type
with_options login_required: true do
end
end
#

View Slide

CommentType
Why Is Visibility Better
Then Other Ways?

View Slide

Why Is Visibility Better?
CommentTyp
# GraphQL query
{
!__schema {
types {
name
}
}
}
GraphQL Introspection

View Slide

AppSchema#execute
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController
Hide Parts of Your Schema

View Slide

Authorization

View Slide

Authorization
CAN this
HOMER HAVE A
BEER?

View Slide

field :posts, PostType.connection_type
with_options login_required: true, admin: true do
end
end
And Again Visibility?

View Slide

Authorization is Flexible
(current_user has role) !||
(current_user has permission) !||
(business rule) !||
!!...

View Slide

def self.authorized?(object, context)
(current_user has role) !||
(current_user has permission) !||
(business rule) !||
end
end
GraphQL Authorization
* authorized? - graphql-ruby feature

View Slide

Authorization
Auth Library
API
Abilities Layer
Helpers (e.g. for templates)
...
(e.g. cancan
or pundit)

View Slide

Authorization
Auth Library
API
Abilities Layer
Helpers (e.g. for templates)
...
(e.g. cancan
or pundit)
GraphQL
RESTfull
? How to use Library ?

View Slide

Ability For Each Action
UsersController
PostsController
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
*ACCESS
CONTROL 
LAYER
GET /users
can? :read, Image
can? :create, Image
can? :read, @post
can? :update, @post
!!...

View Slide

Ability For Each Action
UsersController
PostsController
POST /users
ImagesController
...
GET /posts/:id
PUT /posts/:id
...
GET /images
POST /images
...
*ACCESS
CONTROL 
LAYER
GET /users
can? :read, Image
can? :create, Image
can? :read, @post
can? :update, @post
!!...
CONTROLLER RESOURCE

View Slide

AppSchema#execute
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController
Ability For Each Node

View Slide

AppSchema#execute
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController
Ability For Each Node
author (String)
body (String)

View Slide

1+ Endpoints for Sets of Fields
PostsController
GET /posts/:id
PUT /posts/:id
...
*ACCESS
CONTROL 
LAYER
Admin::PostsController
GET /admin/posts/:id
PUT /admin/posts/:id
...
Post
id
title
body
published_at

View Slide

Can We (re)Use Existing
Abilities Layer?

View Slide

Yes, but ...
• How to pass the current_user?
• How to handle unauthorized error?
• How to ensure authorization happens?
• Hot to get rid of boilerplate?
...
def profile
profile = user.profile
can :read?, profile
profile
end
end

View Slide

def profile
profile = user.profile
can :read?, profile
profile
end
end
Yes, but ...
• How to pass the current_user?
• How to handle unauthorized error?
• How to ensure authorization happens?
• Hot to get rid of boilerplate?
...
Library Helpers

View Slide

GraphQL Pro

View Slide

Who Has Heard about
gem "action_policy"?

View Slide

gem "action_policy"
The Authorization Framework

View Slide

gem "action_policy"
+
GraphQL
!==
gem "action_policy-graphql"

View Slide

field :profile, ProfileType, authorize: true
end
class ProfilePolicy < ApplicationPolicy
def show?
current_user.id !== record.id
end
end
As Easy as Possible

View Slide

# in your schema file
rescue_from(ActionPolicy!::Unauthorized) do |exp|
raise GraphQL!::ExecutionError.new(
exp.result.message,
extensions: {
code: :unauthorized,
fullMessages: exp.result.reasons.full_messages,
details: exp.result.reasons.details
}
)
end
Handling Exceptions

View Slide

# All Docs
GraphQL Features

View Slide

AppSchema#execute
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController
Scoping Data
admin?
manager?
owner?
guest?

View Slide

field :posts,
PostType.connection_type, authorized_scope: true
end
class PostPolicy < ApplicationPolicy
# rel !== user.posts
relation_scope do |rel|
next rel.with_deleted if current_user.admin?
next rel if user !== current_user
rel.where(published: true)
end
end
Scoping Data

View Slide

UI/UX
CAN
HOMER PRESS
THE BUTTON?

View Slide

Where is the best place for UX element display logic?
On Backend
On Frontend
On Both sides
UI/UX
1.
2.
3.

View Slide

On Backend
On Frontend
On Both sides
UI/UX

Expose
Where is the best place for UX element display logic?

View Slide

class PostType < BaseType
expose_authorization_rules :edit?, :destroy?
end
UI/UX

View Slide

UI/UX
{
post(id: $id) {
canEdit {
value # bool
message # top-level decline message
reasons { # detailed information
details
fullMessage
}
}
!!...
}

View Slide

Hot Abilities

View Slide

AppSchema#execute
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController
Hot Abilities
can :edit?

View Slide

field :profile, ProfileType, authorize: true
end
class ProfilePolicy < ApplicationPolicy
cache :show?
def show?
# heavy calculation
end
end
Let's Cache it!

View Slide

Why We Are Talking
Only About Reading Data?

View Slide

AppSchema#execute
GraphQL Internals
Types--
Mutations--
POST /graphql
TagType
UserType
PostType ImageType
ProﬁleType
CommentType
CreatePostMutation
AddCommentMutation
GraphqlController

View Slide

class CreatePostMutation < BaseMutation
!!...
def resolve(post:, *attrs)
authorize! post, to: :create?
# business logic here
end
end
Mutations !!<=> Service Objects

View Slide

class CreatePostMutation < BaseMutation
!!...
def resolve(post:, *attrs)
authorize! post, to: :create?
# business logic here
end
end
Mutations !!<=> Service Objects
# after_action :verify_authorized
How to ensure policies are used?

View Slide

Ensuring Policies are Used
class BaseMutation < GraphQL!::Schema!::RelayClassicMutation
after_resolve do
raise "Unauthorized mutation" unless @authorization_performed
end
def authorize!(*)
@authorization_performed = true
super
end
def skip_authorization!
@authorization_performed = true
end
end *Full gist: https://bit.ly/2UYZpSX

View Slide

Testing

View Slide

Only Integration Tests
describe PostType do
let(:query) do
!<<~GRAPHQL
query($id: ID!){
node(id: $id) {
!!...
}
}
GRAPHQL
end
let(:context) { current_user: create(:user) }
it "checks execution" do
result = AppSchema.execute(query, context: context, !!...)
expect(result["data"]["node"][!!...]).to eq(!!...)
end
end

View Slide

Auth Tests
describe "#somefield" do
context "when user is admin" do
let(:current_user) { create(:admin) }
# it !!...
end
context "when user is owner" do
let(:current_user) { create(:user, post: post) }
# it !!...
end
context "when user is guest" do
let(:current_user) { nil }
# it !!...
end
end
end

View Slide

Bad Auth Tests
Testing is not
what they should
Slow
Complex
context "when user is admin" do
let(:current_user) { create(:admin) }
# it !!...
end
context "when user is owner" do
let(:current_user) { create(:user, post: post) }
# it !!...
end
context "when user is guest" do
let(:current_user) { nil }
# it !!...
end
end
end

View Slide

Good Auth Tests
let(:post) { create(:post) }
subject { # call AppSchema.execute(id: post.id) here }
it "is authorized" do
expect { subject }.to be_authorized_to(:show?, post)
.with(PostPolicy)
end
end
end

View Slide

Conclusion

View Slide

Conclusion
Shared
Auth*
Libraries
Features
Features
RESTful GraphQL

View Slide

Conclusion
Shared
Auth*
Libraries
Features
Features
RESTful GraphQL
/
/
/
/
/
/ /

View Slide

Conclusion
Shared
Auth*
Libraries
Features
Features
RESTful GraphQL
/
/
/
/
/ /
/

View Slide

@ssnickolay
Nikolay Sverchkov
@ssnickolay
THANK YOU!
@evilmartians
http://evl.ms/blog
http://evl.ms/telegram

View Slide

Authorization in the GraphQL era

Authorization in the GraphQL era

Nikolay Sverchkov

More Decks by Nikolay Sverchkov

Other Decks in Programming

Featured

Transcript