graphql-authz
GraphQL-Authz is a Python3.6+ port of GraphQL-Authz, the node.js implementation for the Casbin authorization middleware.
This package should use with GraphQL-core 3, allowing to limit access to each endpoint using casbin policy.
Installation
Install the package using pip.
pip install graphql-authz
Get Started
This package should use with graphql and graphql-middleware. To limit access to each graphql resource you can use a casbin policy. For example, given this policy for an RBAC model:
p, authorized_user, hello, query
Validation can be enforced using:
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
casbin_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
For more interesting scenarios see tests folder.
Credits
This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.
1.9k Jan 1, 2023
1.3k Dec 31, 2022
839 Dec 31, 2022
301 Dec 9, 2022
2.8k Jan 1, 2023
64 Feb 19, 2022
1 Jan 07, 2023
19 Jun 29, 2022
1.3k Jan 05, 2023
89 Dec 28, 2022
12 Oct 25, 2022
3 Jan 02, 2022
8k Jan 09, 2023
9 Nov 25, 2022
1.4k Dec 29, 2022
12 Dec 28, 2022
2 Dec 30, 2021
147 Nov 02, 2022
20 Feb 08, 2022