Graphql 4.0 Create Authorization

Drivers & Stacks GraphQL & GRANDstack
2

Hi,
I have the same issue, though I think I went a little farer than you. See my post here.

I managed to require that a post should only be created by its author, but I did not managed to prevent post from deletion.

About your code:

  • I'm surprised that it is working because operations is not allowed in @authorization
  • User should be protected by @authorization, not by @authentication. This is enough to let the system verify that only the author can create the post:
type User @authorization(validate: [{ when: [BEFORE], where: { node: { id: "$jwt.sub" } } }]){
...
  • I managed to add @authorization for Post but it has to include a when: [AFTER] section:
type Post
  @authorization(
     validate: [{
       when: [AFTER],
       where: { node: { author: { id: "$jwt.sub" } } } 
     }]
  ) {

Unfortunately, as previously written, no way here to prevent post from deletion.

Please keep me informed if you could do it.

(I'm also interested in shield, but I confess that I'm tired to get this low documented thing working, I'd rather downgrade to previous version).