-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enforce directives #895
Comments
Subscription execution directives should be supported See #760 |
I took a deeper look at it and it seems like the same bug is on QUERY and MUTATION. There would be an easy fix to generate the code different (no switch on directive name) if only one directive can be applied to query, mutation and subscription. I can make a PR. For multiple directives on QUERY, MUTATION and SUBSCRIPTION however the e.g. This could result in recursive or complicated nesting. Perhaps it would be an idea to use a middleware chainer (something equivalent to https://medium.com/@chrisgregory_83433/chaining-middleware-in-go-918cfbc5644d ). |
I implemented a chain of multiple directives as middleware where all of them are always executed server side. However after implementing it, i think there is no real bug in the codegeneration, but perhaps a misconception about directives / to less control over the directive generation process. The chat example is a misleading usecase of a subscription directive.
but not as an optional subscription directive. The docs about hasRole directives ( https://gqlgen.com/reference/directives/ ) are also misleading, because with the current implementation the client can always choose to send the query without the @hasRole directive. @hasRole is than never called and the server won´t check the user role at all - if you just followed the docs you have a big security issue here. Besides the main functionality to manipulate the gql directives could be used as an annotation and thats where those misconceptions come from, because the particular implementation specifies what exactly the annotation means. The graphQl specs just say it could be used in other tooling like client side implementation/generation or server-side implementation/generation. gqlgen provides just one special case (optional and based on client query input) of possible use cases.
However gqlgen as a server code generator needs a mechanism to decide wether to enforce a serverside directive, or make it optional and wether to read values from client requests or from the internal schema directive definition. One approach could be to split up a schema to a client schema and a server schema (see the built in client directive to perform client side cache operations from the apollo client implementation Another approach to generate from a single graphql schema could be a naming convention like By the way: Serverside implementations of directives on query, mutation or subscription level require runtime transformations and therefore these directives are not fully implemented or getting a special treatment as well in other gql-server implementations ( |
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. |
Has this been resolved? Seems like it breaks the use case of using directives for enforcing authorization/permissions? |
What happened?
directives on subscription (and perhaps on other elements) are not called if not provided via query:
on examples/chat the query
subscription @user(username:"tester") { messageAdded(roomName:"#gophers") { text createdBy } }
calls the directive
directive @user(username: String!) on SUBSCRIPTION
,but if you do not provide it like
subscription { messageAdded(roomName:"#gophers") { text createdBy } }
the directive is not called at all.
This makes it impossible to
return an error like
return nil, fmt.Errorf("username must be provided")
directly from the directive.
(However you can implement an explicit check in all subscription resolvers, but whats the point of an directive then...)
What did you expect?
directives are called everytime, not only when they are provided by the user
Minimal graphql.schema and models to reproduce
See examples/chat
perhaps add
to the directive and
to the Resolver MessageAdded
versions
gqlgen version
? latestgo version
? latestThe text was updated successfully, but these errors were encountered: