Skip to content

Update authorization docs to Graphene 2.0 #506

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 5, 2018
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 24 additions & 10 deletions docs/authorization.rst
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Let's use a simple example model.
Limiting Field Access
---------------------

This is easy, simply use the ``only_fields`` meta attribute.
To limit fields in a GraphQL query simply use the ``only_fields`` meta attribute.

.. code:: python

Expand Down Expand Up @@ -63,8 +63,9 @@ define a resolve method for that field and return the desired queryset.
class Query(ObjectType):
all_posts = DjangoFilterConnectionField(PostNode)

def resolve_all_posts(self, args, info):
return Post.objects.filter(published=True)
def resolve_all_posts(self, info):
return Post.objects.filter(published=True)


User-based Queryset Filtering
-----------------------------
Expand Down Expand Up @@ -95,7 +96,7 @@ schema is simple.

result = schema.execute(query, context_value=request)

Filtering ID-based node access
Filtering ID-based Node Access
------------------------------

In order to add authorization to id-based node access, we need to add a
Expand All @@ -113,37 +114,50 @@ method to your ``DjangoObjectType``.
interfaces = (relay.Node, )

@classmethod
def get_node(cls, id, context, info):
def get_node(cls, id, info):
try:
post = cls._meta.model.objects.get(id=id)
except cls._meta.model.DoesNotExist:
return None

if post.published or context.user == post.owner:
if post.published or info.context.user == post.owner:
return post
return None

Adding login required

Adding Login Required
---------------------

If you want to use the standard Django LoginRequiredMixin_ you can create your own view, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``:
To restrict users from accessing the GraphQL API page the standard Django LoginRequiredMixin_ can be used to create your own standard Django Class Based View, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``.:

.. code:: python

#views.py

from django.contrib.auth.mixins import LoginRequiredMixin
from graphene_django.views import GraphQLView


class PrivateGraphQLView(LoginRequiredMixin, GraphQLView):
pass

After this, you can use the new ``PrivateGraphQLView`` in ``urls.py``:
After this, you can use the new ``PrivateGraphQLView`` in the project's URL Configuration file ``url.py``:

For Django 1.9 and below:

.. code:: python

urlpatterns = [
# some other urls
url(r'^graphql', PrivateGraphQLView.as_view(graphiql=True, schema=schema)),
]

For Django 2.0 and above:

.. code:: python

urlpatterns = [
# some other urls
path('graphql', PrivateGraphQLView.as_view(graphiql=True, schema=schema)),
]

.. _LoginRequiredMixin: https://docs.djangoproject.com/en/1.10/topics/auth/default/#the-loginrequired-mixin