Resolvers structure & Authentication about go-graphql-api-boilerplate HOT 3 CLOSED

I agree we might put them in the JWT / Context. I think it would be great addition to this boiler plate. It is a great addition to boilerplate code. As many examples have user registration and authentication, but lack user permission examples such as "Administrator", "Editor", "Reviewer"

from go-graphql-api-boilerplate.

1. Resolver structure

🤔I think I need more time or idea about this issue. I totally agree with your thought.

2. Auth on some queries

Yes, it is already implemented in. Authenticate handler is parsing and validating Authorization header of request and put it into Context for resolvers to auth this request sender.

// Request Context : auth.go

func Authenticate(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// var userID *string

		ctx := r.Context()
		userID, err := validateAuthHeader(ctx, r)
		if err != nil {
			// should do something here
		}

		if userID != nil {
			ctx = context.WithValue(ctx, ContextKey("userID"), *userID)
		}

		h.ServeHTTP(w, r.WithContext(ctx))
	})
}

func validateAuthHeader(ctx context.Context, r *http.Request) (*string, error) {
	tokenString := r.Header.Get("Authorization")
	if tokenString == "" {
		return nil, nil
	}

	userID, err := utils.ValidateJWT(&tokenString)
	return userID, err
}

// Resolver side
func (r *Resolvers) GetMyProfile(ctx context.Context) (*GetMyProfileResponse, error) {
	userID := ctx.Value(handler.ContextKey("userID"))

	if userID == nil {
		msg := "Not Authorized"
		return &GetMyProfileResponse{Status: false, Msg: &msg, User: nil}, nil
	}

3. Auth for group membership

I think it is possible with validateAuthHeader handler. When it checks the JWT in header and query the DB to know which user is and role, etc. Then we can put this kind of information into Context for resolvers.

What do you think?

from go-graphql-api-boilerplate.

Thanks for your suggestions.

from go-graphql-api-boilerplate.