Can Shield help ensure ownership?

[ghost]

Thanks for maintaining a great project :)

I'm hoping to use graphql-shield to lock down my API. Currently I'm using https://github.com/maticzav/graphql-middleware-forward-binding to forward requests to the auto-generated resolvers.

Based on your post (https://medium.com/@maticzav/graphql-shield-9d1e02520e35), does the isCustomer function ensure that customers can only add items to their own basket? Or how would you add that logic to the function?

When calling addItemToBasket, are the args of that mutation passed along to isCustomer?

I'm using a JWT in the auth header, with a unique ID in the payload. Does that come through in the ctx variable in some way?

Thanks!

[maticzav]

Hey @everdev 👋,

I see what you are trying to do. Customer, in case of the example, doesn't ensure that the basket belongs to the particular user. I would say that these two problems are of a bit different nature. Let me explain the idea;

When using Prisma only as a database layer, we can implicitly define which basket we want to add items to. In case of the example, we obtain user's basketId and connect the item to it. isCustomer, in this case only ensures the user is logged in and properly set up.

Your case is, in my opinion, a bit different. In a way, it is more flexible which might in terms of security not be the best outcome. Nevertheless, let's se what we can do. Since you are passing the basketId as one of the data arguments we could check if a basket with such id and our user as an owner exists. This is very similar to Graphcool approach if you ever used Graphcool Framework.

A quick code example might be something like this;

const isOwnerOfTheBasket = rule()(async (parent, args, ctx, info) => {
  const basketID = args.data.basketID
  const userID = ctx.user.id

  return ctx.db.exists.Basket({
    id: basketID,
    owner: { id: userID }
  })
})

If you are not yet familiar with Graphcool like permissions approach, I encourage you to read the old permissions docs and learn as much as possible from the idea. To give you a bit of headstart, permission queries have been renamed to .exists in Prisma.

https://www.graph.cool/docs/reference/auth/authorization/overview-iegoo0heez

To answer your last two questions, yes! Both args, and ctx are forwarded to your rule from the present field resolver. What I mean by "present" is that you have to take into account that args differ from field to field and are not the same throughout the query execution.

Hope this answers your question! 🙂

Also, if you have some time, please open up another issue with feature/docs request for example with graphql-middleware-forward-binding, or even better create a PR with your case! 🎉

[ghost]

Perfect! I think that example code will work well :)