graphql-authz is an casbin authorization middleware for GraphQL
Project description
graphql-authz
GraphQL-Authz is a Python3.6+ port of GraphQL-Authz, the Casbin authorization middleware implementation in Node.js.
This package should be used with GraphQL-core 3, providing the capability to limit access to each GraphQL resource with the authorization middleware.
Installation
Install the package using pip.
pip install casbin-graphql-authz
Get Started
Limit the access to each GraphQL resource with a policy. For example, given this policy for an RBAC model:
p, authorized_user, hello, query
Authorization can be enforced using:
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
authorization_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[authorization_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[authorization_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
For more interesting scenarios see tests
folder.
Credits
Implementation was heavily inspired by the Node.js middleware GraphQL-Authz.
Authorization enforcement is based on Casbin authorization library.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for casbin-graphql-authz-1.0.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | eee4b5fb1ef0a234de1d15bf7c57d2622897325a3cb7a6908bcc061cf47fa8ab |
|
MD5 | fe3187ec678dc7f42a4f7bd33905be4b |
|
BLAKE2b-256 | d18dce421172b4e9075534252efed83a5cf61b401136481d55273e32cfdb0221 |
Hashes for casbin_graphql_authz-1.0.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 425bb3b924834a2095d62f28b2b99a4b01391d9431243aad353f8dcd4e2417d7 |
|
MD5 | db0ffc800bc6805d64998c693107bb14 |
|
BLAKE2b-256 | 0cb9402f4169ff22196cb0e2e4bc2665ef77e5e9da0d772dee3bff818d19ceab |