class GraphQR::PermittedFieldsExtension

This is an extension used on the `GraphQR::Fields::BaseField`.

It is responsible for authorizing each field within a query. It searches if the field is defined on the `permitted_fields` method of the policy

Public Instance Methods

resolve(object:, arguments:, context:) { |object, arguments, nil| ... } click to toggle source
# File lib/graphqr/permitted_fields_extension.rb, line 10
def resolve(object:, arguments:, context:)
  if authorized?(object, context)
    yield(object, arguments, nil)
  else
    on_unauthorized
  end
end

Private Instance Methods

authorized?(object, context) click to toggle source
# File lib/graphqr/permitted_fields_extension.rb, line 28
def authorized?(object, context)
  if root_type?(object, context)
    true
  else
    context[:policy_provider].permitted_field?(record: object.object, field_name: field_name)
  end
end
field_name() click to toggle source
# File lib/graphqr/permitted_fields_extension.rb, line 36
def field_name
  field.original_name
end
field_required?() click to toggle source
# File lib/graphqr/permitted_fields_extension.rb, line 24
def field_required?
  !options[:null]
end
on_unauthorized() click to toggle source
# File lib/graphqr/permitted_fields_extension.rb, line 20
def on_unauthorized
  raise GraphQL::ExecutionError, 'You are not authorized to perform this action' if field_required?
end
root_type?(object, context) click to toggle source
# File lib/graphqr/permitted_fields_extension.rb, line 40
def root_type?(object, context)
  root_types = [context.schema.query.graphql_name, context.schema.mutation.graphql_name]

  root_types.include? object.class.graphql_name
end