title: What is a good pattern for implementing access control in a GraphQL server?
body: <p><strong>Background:</strong></p>
  
  <p>I have a set of models, including a User and various other models, some of which contain references to a User.  I am exposing these models for querying via a GraphQL API generated by <a href="https://github.com/RisingStack/graffiti" rel="noreferrer">Graffiti</a>, backed by a Mongo database using the <a href="https://github.com/RisingStack/graffiti-mongoose" rel="noreferrer">graffiti-mongoose</a> adaptor.  My current REST API (which I am migrating to GraphQL) uses JSON Web Tokens to authenticate users, and has some custom permission logic on the server side to handle access control.</p>
  
  <p><strong>Problem:</strong></p>
  
  <p>I'd like to restrict access to objects in GraphQL based upon the current logged-in user.  Some models should be accessible for reads by unauthenticated calls.  Most other models should be only accessible to the User who created them.  What's the best way to manage access control to objects via the Graffiti-generated API?</p>
  
  <p><strong>In general, are there good patterns of access control for GraphQL?  And in particular, are there any good examples or libraries for doing it with Graffiti?</strong></p>
  
  <p><strong>Notes:</strong></p>
  
  <p>I understand that pre- and post- hooks have <a href="https://github.com/RisingStack/graffiti-mongoose/pull/57" rel="noreferrer">been implemented</a> for graffiti-mongoose, and that they <a href="https://github.com/RisingStack/graffiti-mongoose/issues/42" rel="noreferrer">can be used</a> to do basic binary checks for authentication.  I'd like to see how a more detailed access-control logic could be worked into a GraphQL API.  In the future, we'll want to support things like Administrators who have access to model instances created by a certain group of Users (e.g. Users whose Affiliations include that of the Administrator).</p>