3 ms·
For authorization, from what I've seen you'll generally enforce permissions inside resolvers. You can propagate a capability from one field to it's children, wh
by foota 9y ago
For authorization, from what I've seen you'll generally enforce permissions inside resolvers. You can propagate a capability from one field to it's children, which allows you to not have to look up permissions on children fields.
- patelpankaj 9y agotrue, the context param in resolvers are the way to do so
- foota 9y agoI was actually thinking more about passing it as part of the root. For instance, if a person can see all their friends, then you could construct the root for the friend with something like "public only" permission to that person's info, which would prevent someone from accessing private info when checked properly inside the person type. (Although you certainly can use context at the first resolver, it gets less useful the further down you go imo for authorization)
- patelpankaj 9y agothat also makes sense; and I guess it's just a matter of use-case and preference.