graphql-authz
GraphQL-Authz is a Python3.6+ port of GraphQL-Authz, the node.js implementation for the Casbin authorization middleware.
This package should use with GraphQL-core 3, allowing to limit access to each endpoint using casbin policy.
Installation
Install the package using pip.
pip install graphql-authz
Get Started
This package should use with graphql and graphql-middleware. To limit access to each graphql resource you can use a casbin policy. For example, given this policy for an RBAC model:
p, authorized_user, hello, query
Validation can be enforced using:
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
casbin_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
For more interesting scenarios see tests folder.
Credits
This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.
1.9k Jan 1, 2023
1.3k Dec 31, 2022
839 Dec 31, 2022
301 Dec 9, 2022
2.8k Jan 1, 2023
64 Feb 19, 2022
58 Dec 27, 2022
1 Jan 10, 2022
4 Apr 23, 2022
1.4k Dec 29, 2022
27 Nov 27, 2022
14k Jan 01, 2023
147 Nov 02, 2022
8k Jan 09, 2023
3 May 17, 2022
1 Nov 04, 2021
1 Nov 13, 2021
76 Dec 28, 2022
20 Feb 08, 2022
9 Nov 25, 2022
2 Dec 30, 2021
1 Jan 03, 2022