You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+18-6Lines changed: 18 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -432,7 +432,13 @@ restricted to authenticated users and you can only do this at the root level fie
432
432
schema. Configure the plugin as explained [here](#mounting-operations-into-your-own-schema)
433
433
so this can work.
434
434
435
-
In you main app's schema this is how you might specify if a field needs to be authenticated or not:
435
+
##### Authentication Options
436
+
Wether you setup authentications as a default in the plugin, or you do it at the field level,
437
+
these are the options you can use:
438
+
1.**Any truthy value:** If `current_resource` is not `.present?`, query will return an error.
439
+
1.**A callable object:** Provided object will be called with `current_resource` as the only argument if `current_resource` is `.present?`. If return value of the callable object is false, query will return an authentication error.
440
+
441
+
In your main app's schema this is how you might specify if a field needs to be authenticated or not:
436
442
```ruby
437
443
moduleTypes
438
444
classQueryType < Types::BaseObject
@@ -442,13 +448,11 @@ module Types
442
448
field :public_field, String, null:false, authenticate:false
443
449
# this field requires authentication
444
450
field :private_field, String, null:false, authenticate:true
451
+
# this field requires authenticated users to also be admins
452
+
field :admin_field, String, null:false, authenticate:->(user) { user.admin? }
445
453
end
446
454
end
447
455
```
448
-
**Important:** Currently, the only check the plugin does to see if the user is authenticated or not when executing
449
-
the query, is verifying that `context[:current_resource].present?` in the GraphQL context.
450
-
So, be careful not to populate that key of the context with values other than what `gql_devise_context`
451
-
returns. The option to do more complex verifications will be added in the future.
452
456
453
457
#### Authenticate Before Reaching Your GQL Schema (Deprecated)
454
458
For this you will need to call `authenticate_<model>!` in a `before_action` controller hook.
@@ -506,7 +510,13 @@ restricted to authenticated users and you can only do this at the root level fie
506
510
schema. Configure the plugin as explained [here](#mounting-operations-into-your-own-schema)
507
511
so this can work.
508
512
509
-
In you main app's schema this is how you might specify if a field needs to be authenticated or not:
513
+
##### Authentication Options
514
+
Wether you setup authentications as a default in the plugin, or you do it at the field level,
515
+
these are the options you can use:
516
+
1.**Any truthy value:** If `current_resource` is not `.present?`, query will return an error.
517
+
1.**A callable object:** Provided object will be called with `current_resource` as the only argument if `current_resource` is `.present?`. If return value of the callable object is false, query will return an authentication error.
518
+
519
+
In your main app's schema this is how you might specify if a field needs to be authenticated or not:
510
520
```ruby
511
521
moduleTypes
512
522
classQueryType < Types::BaseObject
@@ -516,6 +526,8 @@ module Types
516
526
field :public_field, String, null:false, authenticate:false
517
527
# this field requires authentication
518
528
field :private_field, String, null:false, authenticate:true
529
+
# this field requires authenticated users to also be admins
530
+
field :admin_field, String, null:false, authenticate:->(user) { user.admin? }
0 commit comments