useGenericAuth always calls validateUser even when @skipAuth

[aslansky]

When using generic auth in "protect-all" mode the documentation states:

Then, in your GraphQL schema SDL, you can add @skipAuth directive to your fields, and the validateUser will not get called while resolving that specific field

This does not seem to be true. The validateUser always gets called, even when @skipAuth is set on the field.

I am not sure if documentation is wrong or there needs to be a check added to the plugins handleField function when @skipAuth is enabled.

[n1ru4l]

Hey @aslansky do you think you can provide a minimal reproduction on CodeSandbox or Stackblitz or even better a PR with a failing test?

[aslansky]

The behaviour is the same for @auth and @skipAuth, but as I said, I am not sure if this is expected behaviour and the user needs to handle the check for fieldAuthDirectiveNode and fieldAuthExtension in the custom validateUser function.

[n1ru4l]

@aslansky From the test it is now more clear to me.

validateUser is called in that case as well because the field could behave differently based on whether a user is authenticated or not. E.g. if you have a Query.feed field it could either resolve to a generic feed if the user resolved from validateUser is null or a customized user feed if the user resolved from validateUser is non-null 9e.g. a user object).

Does that make sense to you? In the meanwhile I will change this issue to a discussion!

[aslansky]

Yes that makes sense. I was just thrown off by the validateUser will not get called while resolving that specific field part in the docs. Thanks for the help. Btw. the code is perfectly readable and makes it really easy to understand whats going on 👍.

[n1ru4l]

@aslansky Can you send a PR for updating the documentation? That would be greatly appreciated 😇

[aslansky]

Sure, I'll try to find some time on the weekend and try to come up with something with my none native english ;-)