I have the situation, that I have Users that should get a smaller Number of items and

Thanks <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-u

Restrict amout of Data about authorization HOT 4 CLOSED

graphql-dotnet commented on July 18, 2024

Restrict amout of Data

from authorization.

Comments (4)

OpenSpacesAndPlaces commented on July 18, 2024

At least two ways I know of off the bat. (I'm sure there are more approaches)

You could do a soft filter with arguments:
https://graphql-dotnet.github.io/docs/getting-started/arguments

Or a hard filter by accessing meta-data from

ExecutionResult result = await _executer.ExecuteAsync(_ =>
{
...
_.UserContext = HttpContext.Current;
...
}

Resolve(ResolveFieldContext rfc)
{
....
rfc.UserContext.User.Identity.Name
//lookup role info
...
}

from authorization.

StefanSchoof commented on July 18, 2024

Thanks @OpenSpacesAndPlaces for your reply.
I was not able to figure out what do you mean by "soft filter". I am now going with the "hard filter".

from authorization.

OpenSpacesAndPlaces commented on July 18, 2024

By "soft filter" I meant something like your UI code sending " Top: 5 " as an argument.
I phrased this as "soft" because someone could just change the request to be "Top: 10".

The hard filter is running off information that's only server accessible.

from authorization.

StefanSchoof commented on July 18, 2024

Thank, I need a server enforced.

This is the code is use:

public DeviceType(IDocumentClient documentClient, IDataLoaderContextAccessor dataLoaderContextAccessor, IAuthorizationEvaluator evaluator)
{
...
            async Task<IEnumerable<Measurement>> measurementsResolve(ResolveFieldContext<Device> context)
            {
                var timespan = context.GetArgument("timespan", TimeSpan.FromDays(1));
                if (timespan > TimeSpan.FromDays(1))
                {
                    var user = context.UserContext as IProvideClaimsPrincipal;
                    var res = await evaluator.Evaluate(user.User, context.UserContext, null, new List<string> { "UserPolicy" });
                    if (!res.Succeeded)
                    {
                        context.Errors.AddRange(res.Errors.Select(e => new ExecutionError(e)));
                        return null;
                    }
                }
                var dataLoader = dataLoaderContextAccessor.Context
                    .GetOrAddCollectionBatchLoader("GetMeasurementsByDeviceId", GetMeasurementsByDeviceId(timespan));

                return await dataLoader.LoadAsync(context.Source.Id);
            }
            Field<ListGraphType<MeasurementType>>(
                "measurements",
                arguments: new QueryArguments(new QueryArgument<TimeSpanSecondsGraphType> { Name = "timespan" }),
                resolve: measurementsResolve
            );