{"action":"created","issue":{"url":"https://api.github.com/repos/nodkz/graphql-compose/issues/29","repository_url":"https://api.github.com/repos/nodkz/graphql-compose","labels_url":"https://api.github.com/repos/nodkz/graphql-compose/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/nodkz/graphql-compose/issues/29/comments","events_url":"https://api.github.com/repos/nodkz/graphql-compose/issues/29/events","html_url":"https://github.com/nodkz/graphql-compose/issues/29","id":187466543,"number":29,"title":"Authentication / Authorization","user":{"login":"atalebagha","id":9886105,"avatar_url":"https://avatars.githubusercontent.com/u/9886105?v=3","gravatar_id":"","url":"https://api.github.com/users/atalebagha","html_url":"https://github.com/atalebagha","followers_url":"https://api.github.com/users/atalebagha/followers","following_url":"https://api.github.com/users/atalebagha/following{/other_user}","gists_url":"https://api.github.com/users/atalebagha/gists{/gist_id}","starred_url":"https://api.github.com/users/atalebagha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/atalebagha/subscriptions","organizations_url":"https://api.github.com/users/atalebagha/orgs","repos_url":"https://api.github.com/users/atalebagha/repos","events_url":"https://api.github.com/users/atalebagha/events{/privacy}","received_events_url":"https://api.github.com/users/atalebagha/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-05T00:52:38Z","updated_at":"2016-11-05T08:16:52Z","closed_at":null,"body":"How do I add authentication/authorization/permissions to queries and mutations?\r\n\r\nexample, User can view all users but can only edit his user account.\r\nUser who is admin of a business can add/remove users from the business and can make/receive payments\r\nUser who is an employee of a business can view payments made to/from the business\r\n"},"comment":{"url":"https://api.github.com/repos/nodkz/graphql-compose/issues/comments/258597891","html_url":"https://github.com/nodkz/graphql-compose/issues/29#issuecomment-258597891","issue_url":"https://api.github.com/repos/nodkz/graphql-compose/issues/29","id":258597891,"user":{"login":"stoffern","id":943968,"avatar_url":"https://avatars.githubusercontent.com/u/943968?v=3","gravatar_id":"","url":"https://api.github.com/users/stoffern","html_url":"https://github.com/stoffern","followers_url":"https://api.github.com/users/stoffern/followers","following_url":"https://api.github.com/users/stoffern/following{/other_user}","gists_url":"https://api.github.com/users/stoffern/gists{/gist_id}","starred_url":"https://api.github.com/users/stoffern/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stoffern/subscriptions","organizations_url":"https://api.github.com/users/stoffern/orgs","repos_url":"https://api.github.com/users/stoffern/repos","events_url":"https://api.github.com/users/stoffern/events{/privacy}","received_events_url":"https://api.github.com/users/stoffern/received_events","type":"User","site_admin":false},"created_at":"2016-11-05T08:16:52Z","updated_at":"2016-11-05T08:16:52Z","body":"It is easier if you provide your code.\r\nFirst off you need to get user ID and pass it into GraphQL if authenticated.\r\n\r\nserver.js\r\n```js\r\napp.use('/graphql', \r\n  graphqlHTTP(req => ({\r\n    schema: Schema,\r\n    graphiql: true,\r\n    context: {\r\n      userId: req.user._id,\r\n    },\r\n  }))\r\n)\r\n```\r\n\r\nUsers.js\r\n```js\r\nvar UserSchema = new mongoose.Schema({\r\n  email : { type: String },\r\n  firstName : { type: String },\r\n  lastName : { type: String },\r\n})\r\nexport const Users = mongoose.model('Users', UserSchema)\r\nexport const UsersTC = composeMongoose(Users)\r\n```\r\n\r\nschema.js\r\n```js\r\nexport const RootQueryTC = GQC.rootQuery()\r\nexport const RootMutationTC = GQC.rootMutation()\r\n\r\nRootQueryTC.addFields({\r\n  users: UsersTC.get('$findMany')\r\n})\r\n\r\nRootMutationTC.addFields({\r\n  userUpdate: UsersTC.get('$updateById')\r\n    .wrapResolve( next => req => {\r\n      if(req.context.userId != req.args.input.record._id)\r\n        throw new Error ('Not allowed')\r\n      return next(req)\r\n    }),\r\n\r\n  addUserToBusiness: BusinessTC.get('$updateById')\r\n    .wrapResolve( next => req => {\r\n        UsersTC.find({_id: req.context.userId}).exec( user => {\r\n          //if not owner throw Error\r\n          //if owner and you want to parse data, change the req data\r\n        })\r\n      return next(req)\r\n    }),\r\n})\r\n\r\nexport default = GQC.buildSchema()\r\n```\r\n"}}
{"actor":{"display_login":"stoffern"}}