graphql-authz
GraphQL-Authz is a Python3.6+ port of GraphQL-Authz, the node.js implementation for the Casbin authorization middleware.
This package should use with GraphQL-core 3, allowing to limit access to each endpoint using casbin policy.
Installation
Install the package using pip.
pip install graphql-authz
Get Started
This package should use with graphql and graphql-middleware. To limit access to each graphql resource you can use a casbin policy. For example, given this policy for an RBAC model:
p, authorized_user, hello, query
Validation can be enforced using:
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
casbin_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
For more interesting scenarios see tests folder.
Credits
This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.
1.9k Jan 1, 2023
1.3k Dec 31, 2022
839 Dec 31, 2022
301 Dec 9, 2022
2.8k Jan 1, 2023
64 Feb 19, 2022
14.5k Jan 08, 2023
2 Dec 30, 2021
1.4k Dec 29, 2022
58 Dec 27, 2022
4 Feb 22, 2022
7 Oct 19, 2022
4 Mar 29, 2022
12 Oct 25, 2022
147 Nov 02, 2022
8k Jan 09, 2023
1 Jan 07, 2023
9 Nov 25, 2022
3 May 17, 2022