Has someone already created a CASL decorator?

[angelhodar]

TypeGraphQL already has a built-in Authorized decorator that is great to use on RBAC. However, I miss some field based control to allow/disallow users to read/write certain row fields without proper permissions. For example, a user should not be able to update its balanceCredits field, but an admin could do it. I am thinking about creating a decorator that uses the great casl library that could be used as the Authorized one, but I have doubts about what would be the performance cost of implementing it on a per field basis because the main use would be to filter fields on response based on user role

[carlocorradini]

Hey, I've created graphql-auth-directive which can be used with TypeGraphQL.
Let me know if it works for your context :)

[carlocorradini]

Is that what you were trying to achieve?

[angelhodar]

Hi Carlo! Yes that was what I was trying to figure out before the resolver execution. So my only doubt now is that in cases where the decorator is used with a prop, the resolverData should contain the info about the prop? For example:

class Example{
   @Auth({
    roles: [UserRoles.ADMIN, UserRoles.USER]
    permissions: [UserPermissions.READ]
  })
   @Field()
   restrictedField: string
}

What if an ADMIN user can always see the field but another user with the USER role can only see the field restrictedField depending on its value? And what is the performance costs of prop decorators? How are they executed?

[carlocorradini]

Since this is custom logic you must implement it in your custom auth function.
The value of restrictedField can be read in pure graphql.js (see this):

import type { AuthFn } from 'graphql-auth-directive'

export const myAuthFn: AuthFn<MyContext, MyRole, MyPermission> = ({ source }, { roles, permissions }) => {
  const value = source.restrictedField;

  // ...
};

Of course, if you want to have the directive to be compatible with both field and "functions" you must check for the correcteness (and have a more complicated logic) but this works :)

[angelhodar]

I would create Restricted decorator for props and Auth for resolvers so I can keep it more simple. And in general what is the performance cost of this directives?

[carlocorradini]

@angelhodar I have no idea :/
Feel free to send a PR 😎🥳