You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ROOT/pages/security/authorization.adoc
+9-5Lines changed: 9 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -174,7 +174,9 @@ type Post @authorization(validate: [
174
174
175
175
== Authorization on fields
176
176
177
-
The `@authorization` directive can be used either on either object types or their fields, with the former being used in examples for the most part on this page. When applied to a field, the authorization rules are only evaluated if the matching operations are performed on that field. For example, consider a `User` type with a `password` field:
177
+
The `@authorization` directive can be used either on object types or their fields, with the former being used in examples for the most part on this page.
178
+
When applied to a field, the authorization rules are only evaluated if the matching operations are performed on that field.
179
+
For example, consider a `User` type with a `password` field:
178
180
179
181
[source, graphql, indent=0]
180
182
----
@@ -208,7 +210,8 @@ However, consider the following query:
208
210
}
209
211
----
210
212
211
-
This will require a valid JWT to have been provided with the request, and the matching users will be filtered down according to the JWT subject. The same will apply for attempting to update the `password` field, the update will only apply to the user matching the JWT.
213
+
This will require a valid JWT to have been provided with the request, and the matching users will be filtered down according to the JWT subject.
214
+
The same applies for attempting to update the `password` field, the update will only apply to the user matching the JWT.
212
215
213
216
214
217
== Authorization without authentication
@@ -237,9 +240,10 @@ type Post @authorization(filter: [
237
240
238
241
== Ordering of rules
239
242
240
-
In each ruleset (`filter` and `validate`), rules are joined with an `OR`. The two rulesets are joined with an `AND`.
243
+
In each ruleset (`filter` and `validate`), rules are joined with an `OR`.
244
+
The two rulesets are joined with an `AND`.
241
245
242
-
An example pseudo-logic would be `(filterRule1 OR filterRule2) AND (validateRule1 OR validateRule2)`.
246
+
For example: `(filterRule1 OR filterRule2) AND (validateRule1 OR validateRule2)`.
243
247
244
248
If ever there are two rules which you would like to be combined with an `AND`, these should be combined into a single rule. Take for instance the following example:
245
249
@@ -254,7 +258,7 @@ type User @authorization(validate: [
254
258
}
255
259
----
256
260
257
-
Say in this example we wanted it to be that a user needs to be an admin _and_ the `locked` property must be `false` in order to update a `User` node. We would need to combine these predicates into a single rule:
261
+
If you want to combine the rule that a user must be an admin with the rule that the `locked` property must be `false` in order to update a `User` node, add them both to the `where` field using `AND` in a single rule:
Copy file name to clipboardExpand all lines: modules/ROOT/pages/types/relationships.adoc
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -65,7 +65,8 @@ You can add relationship properties to the example in two steps:
65
65
. Add a type definition decorated with the `@relationshipProperties` directive, containing the desired relationship properties.
66
66
. Add a `properties` argument to both "sides" (or just one side, if you prefer) of the `@relationship` directive which points to the newly defined interface.
67
67
68
-
Relationship properties fields can only be primitive types or their list variants. You cannot map complex types such as object types into the types modelling relationship properties.
68
+
Relationship properties fields can only be primitive types or their list variants.
69
+
You cannot map complex types such as object types into the types modelling relationship properties.
69
70
70
71
For example, suppose you want to distinguish which roles an actor played in a movie:
0 commit comments