Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix scope source #16

Merged
merged 7 commits into from
Oct 18, 2019
Merged

Fix scope source #16

merged 7 commits into from
Oct 18, 2019

Conversation

gabrielpra1
Copy link
Member

@gabrielpra1 gabrielpra1 commented Oct 18, 2019

  • Remove scope: :source
  • Change scope to scope_by in ObjectScopeAuthorization, using the returned struct as scope
  • Change validations to require any struct instead of an Ecto schema
  • Add meta :rule for FieldAuthorization
  • Use source struct and scope_by for FieldAuthorization scoping
  • Add meta :rule for ObjectScopeAuthorization
  • Unify all scope functions in Rajska (no more context_field_authorized)
  • Test queries that return primitives (e.g. :string)

@gabrielpra1
Copy link
Member Author

@rschef We thought about using the same scope_by for Field and Object. However, now that we don't have meta :scope anymore, the meta scope_by is what defines if we are using ObjectScope or not:

# Using ObjectScope
object :user do
  meta :scope_by, :id
end

# ObjectScope not included in the application, no need to define anything
object :user do
end

# ObjectScope in the application, must be explict about not using scope 
object :user do
  meta :scope_by, false
end

What if we want FieldAuthorization for one object but not ObjectAuthorization?

@rschef
Copy link
Collaborator

rschef commented Oct 18, 2019

@rschef We thought about using the same scope_by for Field and Object. However, now that we don't have meta :scope anymore, the meta scope_by is what defines if we are using ObjectScope or not:

# Using ObjectScope
object :user do
  meta :scope_by, :id
end

# ObjectScope not included in the application, no need to define anything
object :user do
end

# ObjectScope in the application, must be explict about not using scope 
object :user do
  meta :scope_by, false
end

What if we want FieldAuthorization for one object but not ObjectAuthorization?

We could have 3 meta options:

  • scope_by for both field and object authorization
  • scope_object_byfor object authorization
  • scope_field_by for field authorization

lib/schema.ex Show resolved Hide resolved
test/middlewares/object_scope_authorization_test.exs Outdated Show resolved Hide resolved
@rschef rschef merged commit 7973b63 into master Oct 18, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants