graphql-authz
GraphQL-Authz is a Python3.6+ port of GraphQL-Authz, the node.js implementation for the Casbin authorization middleware.
This package should use with GraphQL-core 3, allowing to limit access to each endpoint using casbin policy.
Installation
Install the package using pip.
pip install graphql-authz
Get Started
This package should use with graphql and graphql-middleware. To limit access to each graphql resource you can use a casbin policy. For example, given this policy for an RBAC model:
p, authorized_user, hello, query
Validation can be enforced using:
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
casbin_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
For more interesting scenarios see tests folder.
Credits
This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.
1.9k Jan 1, 2023
1.3k Dec 31, 2022
839 Dec 31, 2022
301 Dec 9, 2022
2.8k Jan 1, 2023
64 Feb 19, 2022
1.3k Jan 05, 2023
12 Dec 28, 2022
58 Dec 27, 2022
109 Dec 23, 2022
5 Nov 22, 2022
4 Apr 23, 2022
8k Jan 09, 2023
33 Dec 18, 2022
19 Jun 29, 2022
282 Jan 04, 2023
15 Dec 31, 2022
144 Dec 26, 2022
1 Jan 07, 2023
89 Dec 28, 2022
267 Dec 24, 2022