Relay node with scope auth

[dohaicuong]

Hi

I just wonder if there is anyway that I can use Auth Plugin together with Relay Plugin to write node.

currently I have builder setup as

// builder.ts

export const builder = new SchemaBuilder<{
  Context: Context
  AuthScopes: Go1AuthScopes
  Scalars: {
    DateTime: {
      Input: string
      Output: string
    }
  }
}>({
  plugins: [RelayPlugin, ScopeAuthPlugin],
  
  relayOptions: {
    clientMutationId: 'omit',
    cursorType: 'String',
  },

  authScopes: parseGo1AuthScopes,
  scopeAuthOptions: {
    runScopesOnType: true,
    unauthorizedError: (_parent, _context, _info, result) => {
      const missingScopes = (
        result.failure as unknown as AuthScopeError
      ).failures.map((f) => f.scope)
      return new GraphQLError('Not authorized', {
        extensions: { missingScopes },
      })
    },
  },
}

and trying to write a relay node

const Playlist = builder.node(PlaylistRef, {
  id: { resolve: ({ id }) => id },

  runScopesOnType: true,
  authScopes: { playlist_read: true },

  fields: t => ({ ... }),
  
  loadOne: (id, context) => fetchApiRequest(...)
}

but now even without the scopes present, the loadOne function is still got called.
I test the same thing on a query and it works properly but not on node

[hayes]

Type level scopes get run after the node is loaded, meaning that loadOne would always be called. This is basically because many scopes need to access information about the node to know if it should be authorized.

If you want to run auth checks before loading, it needs to be done on the node/nodes query fields. You can add this via relayOptions.node(s)FieldOptions.authScopes in the builder options

[dohaicuong]

thank you, it's understandable but in my case I would only check for the scopes in jwt token payload to know if it's authorized.

About the relayOptions.node(s)FieldOptions.authScopes, this will set for all nodes.
Is there any way I can set this before loading auth check for a single node?

[dohaicuong]

or this would be outside the scope of this plugin and should be something else?

[hayes]

There are 2 options:

You can define a scope on the node/nodes field using a callback so you have access to the id(s) arg, which should let you get the typename and apply checks based on the type.

Alternatively you can add a check inside the loadOne method using await builder.runAuthScopes(context, scopes)

[dohaicuong]

cool thank you