palkan/action_policy-graphql

no examples of authorized_scope with relay connection type

lifeiscontent opened this issue · 7 comments

lifeiscontent commented

Hey @palkan,

Hope you're doing well.

I was wondering if you could show an example of how I might implement an authorized_scope with a relay connection.

I tried setting it up initially but it gave me the following error:

Couldn't find policy class for [#<Types::QueryType:0x00007f986eb5a730 @object=nil, @context=#<Query::Context ...>, @__policies_cache__={\"//70146334492460\"=>nil}, @authorization_namespace=Types>, \"Couldn't find implicit authorization target for Types::QueryType. Please, provide policy class explicitly using `with` option or define the `implicit_authorization_target` method.\"] (Array)```
palkan commented

Could you please provide a bit more context? For example, schema fragment, policies structure.

We're using Action Policy with connections without any additional setup.

lifeiscontent commented

@palkan i believe this error shows up when you set connection: true on a field

palkan commented

I added some specs for connections and they pass without any code change: de73a58

So, returning to the previous question

Could you please provide a bit more context? For example, schema fragment, policies structure.

lifeiscontent commented

@palkan hey, I think I might have been using the DSL wrong, previously when I had a connection type I used a Type.connection_type, connection: true on the field, and I believe that's when I saw it blowing up, but really, this is a misunderstanding of the API on my behalf.

Thanks for putting in so much awesome work into this! :)

As a side note, I'm using action policy for an example app I built, including test coverage: https://github.com/lifeiscontent/realworld

you can see it live here, though it's on heroku free tier so it might take a second to boot.

https://realworld.now.sh

  • 👍1
palkan commented

As a side note, I'm using action policy for an example app I built

Thanks for sharing!

P.S. Quick suggestion: you can use pre-checks to avoid calling user? in most places.

lifeiscontent commented

@palkan can you show me what that would look like?

palkan commented

You can add the following to your application policy:

class ApplicationPolicy < ActionPolicy::Base
  pre_check :deny_unauthenticated

  def deny_unauthenticated
    deny! unless user?
  end
end

And then you can remove user? checks from all the rules

  • 🎉1