Skip to content

Commit 4b1873c

Browse files
committed
Document authenticate with callable [ci skip]
1 parent 0343c07 commit 4b1873c

1 file changed

Lines changed: 18 additions & 6 deletions

File tree

README.md

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -432,7 +432,13 @@ restricted to authenticated users and you can only do this at the root level fie
432432
schema. Configure the plugin as explained [here](#mounting-operations-into-your-own-schema)
433433
so this can work.
434434

435-
In you main app's schema this is how you might specify if a field needs to be authenticated or not:
435+
##### Authentication Options
436+
Wether you setup authentications as a default in the plugin, or you do it at the field level,
437+
these are the options you can use:
438+
1. **Any truthy value:** If `current_resource` is not `.present?`, query will return an error.
439+
1. **A callable object:** Provided object will be called with `current_resource` as the only argument if `current_resource` is `.present?`. If return value of the callable object is false, query will return an authentication error.
440+
441+
In your main app's schema this is how you might specify if a field needs to be authenticated or not:
436442
```ruby
437443
module Types
438444
class QueryType < Types::BaseObject
@@ -442,13 +448,11 @@ module Types
442448
field :public_field, String, null: false, authenticate: false
443449
# this field requires authentication
444450
field :private_field, String, null: false, authenticate: true
451+
# this field requires authenticated users to also be admins
452+
field :admin_field, String, null: false, authenticate: ->(user) { user.admin? }
445453
end
446454
end
447455
```
448-
**Important:** Currently, the only check the plugin does to see if the user is authenticated or not when executing
449-
the query, is verifying that `context[:current_resource].present?` in the GraphQL context.
450-
So, be careful not to populate that key of the context with values other than what `gql_devise_context`
451-
returns. The option to do more complex verifications will be added in the future.
452456

453457
#### Authenticate Before Reaching Your GQL Schema (Deprecated)
454458
For this you will need to call `authenticate_<model>!` in a `before_action` controller hook.
@@ -506,7 +510,13 @@ restricted to authenticated users and you can only do this at the root level fie
506510
schema. Configure the plugin as explained [here](#mounting-operations-into-your-own-schema)
507511
so this can work.
508512

509-
In you main app's schema this is how you might specify if a field needs to be authenticated or not:
513+
##### Authentication Options
514+
Wether you setup authentications as a default in the plugin, or you do it at the field level,
515+
these are the options you can use:
516+
1. **Any truthy value:** If `current_resource` is not `.present?`, query will return an error.
517+
1. **A callable object:** Provided object will be called with `current_resource` as the only argument if `current_resource` is `.present?`. If return value of the callable object is false, query will return an authentication error.
518+
519+
In your main app's schema this is how you might specify if a field needs to be authenticated or not:
510520
```ruby
511521
module Types
512522
class QueryType < Types::BaseObject
@@ -516,6 +526,8 @@ module Types
516526
field :public_field, String, null: false, authenticate: false
517527
# this field requires authentication
518528
field :private_field, String, null: false, authenticate: true
529+
# this field requires authenticated users to also be admins
530+
field :admin_field, String, null: false, authenticate: ->(user) { user.admin? }
519531
end
520532
end
521533
```

0 commit comments

Comments
 (0)