You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/authorization.rst
+27-11Lines changed: 27 additions & 11 deletions
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ Let's use a simple example model.
20
20
Limiting Field Access
21
21
---------------------
22
22
23
-
This is easy, simply use the ``only_fields`` meta attribute.
23
+
To limit fields in a GraphQL query simply use the ``only_fields`` meta attribute.
24
24
25
25
.. code:: python
26
26
@@ -63,8 +63,12 @@ define a resolve method for that field and return the desired queryset.
63
63
classQuery(ObjectType):
64
64
all_posts = DjangoFilterConnectionField(PostNode)
65
65
66
-
defresolve_all_posts(self, args, info):
67
-
return Post.objects.filter(published=True)
66
+
defresolve_all_posts(self, info):
67
+
post = Post.objects.filter(published=True)
68
+
if post isnotNone:
69
+
return post
70
+
else:
71
+
returnNone
68
72
69
73
User-based Queryset Filtering
70
74
-----------------------------
@@ -95,7 +99,7 @@ schema is simple.
95
99
96
100
result = schema.execute(query, context_value=request)
97
101
98
-
Filtering ID-based node access
102
+
Filtering ID-based Node Access
99
103
------------------------------
100
104
101
105
In order to add authorization to id-based node access, we need to add a
@@ -113,37 +117,49 @@ method to your ``DjangoObjectType``.
113
117
interfaces = (relay.Node, )
114
118
115
119
@classmethod
116
-
defget_node(cls, id, context, info):
120
+
defget_node(cls, id, info):
117
121
try:
118
-
post =cls._meta.model.objects.get(id=id)
122
+
post =cls._meta.model.objects.get(id=id, owner__user= info.context.user)
119
123
exceptcls._meta.model.DoesNotExist:
120
124
returnNone
121
125
122
-
if post.published or context.user == post.owner:
126
+
if post.published orinfo.context.user == post.owner:
123
127
return post
124
128
returnNone
125
129
126
-
Adding login required
130
+
Adding Login Required
127
131
---------------------
128
132
129
-
If you want to use the standard Django LoginRequiredMixin_ you can create your own view, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``:
133
+
To restrict users from accessing the GraphQL API page the standard Django LoginRequiredMixin_ can be used to create your own standard Django Class Based View, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``.:
130
134
131
135
.. code:: python
132
-
136
+
#views.py
137
+
133
138
from django.contrib.auth.mixins import LoginRequiredMixin
0 commit comments