Skip to content

Commit 84d82f8

Browse files
authored
Update authorization docs to Graphene 2.0
* Re-write some language in "Limiting Field Access" * Added code to "Queryset Filtering On Lists" section to handle queries that return nothing * fix code to Filtering ID-based node access to work based on question [here](https://stackoverflow.com/questions/51057784/django-graphene-with-relay-restricting-queries-access-based-on-id/51958088#51958088) * Rewrote Adding Login Requirements to be Django 2.0 compatible Fixed login requirements
1 parent 9351626 commit 84d82f8

File tree

1 file changed

+27
-11
lines changed

1 file changed

+27
-11
lines changed

docs/authorization.rst

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Let's use a simple example model.
2020
Limiting Field Access
2121
---------------------
2222

23-
This is easy, simply use the ``only_fields`` meta attribute.
23+
To limit fields in a GraphQL query simply use the ``only_fields`` meta attribute.
2424

2525
.. code:: python
2626
@@ -63,8 +63,12 @@ define a resolve method for that field and return the desired queryset.
6363
class Query(ObjectType):
6464
all_posts = DjangoFilterConnectionField(PostNode)
6565
66-
def resolve_all_posts(self, args, info):
67-
return Post.objects.filter(published=True)
66+
def resolve_all_posts(self, info):
67+
post = Post.objects.filter(published=True)
68+
if post is not None:
69+
return post
70+
else:
71+
return None
6872
6973
User-based Queryset Filtering
7074
-----------------------------
@@ -95,7 +99,7 @@ schema is simple.
9599
96100
result = schema.execute(query, context_value=request)
97101
98-
Filtering ID-based node access
102+
Filtering ID-based Node Access
99103
------------------------------
100104

101105
In order to add authorization to id-based node access, we need to add a
@@ -113,37 +117,49 @@ method to your ``DjangoObjectType``.
113117
interfaces = (relay.Node, )
114118
115119
@classmethod
116-
def get_node(cls, id, context, info):
120+
def get_node(cls, id, info):
117121
try:
118-
post = cls._meta.model.objects.get(id=id)
122+
post = cls._meta.model.objects.get(id=id, owner__user = info.context.user)
119123
except cls._meta.model.DoesNotExist:
120124
return None
121125
122-
if post.published or context.user == post.owner:
126+
if post.published or info.context.user == post.owner:
123127
return post
124128
return None
125129
126-
Adding login required
130+
Adding Login Required
127131
---------------------
128132

129-
If you want to use the standard Django LoginRequiredMixin_ you can create your own view, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``:
133+
To restrict users from accessing the GraphQL API page the standard Django LoginRequiredMixin_ can be used to create your own standard Django Class Based View, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``.:
130134

131135
.. code:: python
132-
136+
#views.py
137+
133138
from django.contrib.auth.mixins import LoginRequiredMixin
134139
from graphene_django.views import GraphQLView
135140
136141
137142
class PrivateGraphQLView(LoginRequiredMixin, GraphQLView):
138143
pass
139144
140-
After this, you can use the new ``PrivateGraphQLView`` in ``urls.py``:
145+
After this, you can use the new ``PrivateGraphQLView`` in the project's URL Configuration file ``url.py``:
146+
147+
For Django 1.9 and below:
141148

142149
.. code:: python
143150
144151
urlpatterns = [
145152
# some other urls
146153
url(r'^graphql', PrivateGraphQLView.as_view(graphiql=True, schema=schema)),
147154
]
155+
156+
For Django 2.0 and above:
157+
158+
.. code:: python
159+
160+
urlpatterns = [
161+
# some other urls
162+
path('graphql', PrivateGraphQLView.as_view(graphiql=True, schema=schema)),
163+
]
148164
149165
.. _LoginRequiredMixin: https://docs.djangoproject.com/en/1.10/topics/auth/default/#the-loginrequired-mixin

0 commit comments

Comments
 (0)