Implement permissions layer using GraphQL Shield

package.json

@@ -11,9 +11,10 @@
   "dependencies": {
     "bcryptjs": "2.4.3",
     "graphql": "0.13.2",
+    "graphql-shield": "3.0.0",
     "graphql-tag": "2.9.2",
     "graphql-tools": "3.1.1",
-    "graphql-yoga": "1.16.2",
+    "graphql-yoga": "^1.16.2",
     "jsonwebtoken": "8.3.0",
     "prisma-binding": "2.1.5"
   },

src/index.ts

@@ -1,18 +1,32 @@
 import { GraphQLServer } from 'graphql-yoga'
 import { Prisma } from './generated/prisma'
-import { resolvers, fragmentReplacements } from './resolvers'
-
-const db = new Prisma({
-  fragmentReplacements,
-  endpoint: process.env.PRISMA_ENDPOINT,
-  secret: process.env.PRISMA_SECRET,
-  debug: true,
-})
+import {
+  resolvers,
+  fragmentReplacements as resolverFragmentReplacements,
+} from './resolvers'
+import { permissions } from './permissions'
 
 const server = new GraphQLServer({
   typeDefs: './src/schema.graphql',
   resolvers,
-  context: req => ({ ...req, db }),
+  middlewares: [permissions],
+  context: ({
+    request,
+    response,
+    fragmentReplacements: middlewareFragmentReplacements,
+  }) => ({
+    request,
+    response,
+    db: new Prisma({
+      fragmentReplacements: [
+        ...middlewareFragmentReplacements,
+        ...resolverFragmentReplacements,
+      ],
+      endpoint: process.env.PRISMA_ENDPOINT,
+      secret: process.env.PRISMA_SECRET,
+      debug: true,
+    }),
+  }),
 })
 
 server.start(({ port }) =>

src/permissions/index.ts

@@ -0,0 +1,32 @@
+import { shield } from 'graphql-shield'
+
+import {
+  isUserAuthenticated,
+  // isUserSelf,
+  // isUserPaymentAccountOwner,
+  isUserPlaceOwner,
+  // isUserBookingOwner,
+} from './rules'
+
+export const permissions = shield({
+  Mutation: {
+    addPaymentMethod: isUserAuthenticated,
+    book: isUserAuthenticated,
+  },
+  // User: {
+  //   paymentAccount: isUserSelf,
+  //   token: isUserSelf,
+  //   booking: isUserSelf,
+  //   ownedPlaces: isUserSelf,
+  //   receivedMessages: isUserSelf,
+  //   sentMessages: isUserSelf,
+  //   notifications: isUserSelf,
+  // },
+  // PaymentAccount: isUserPaymentAccountOwner,
+  Place: {
+    reviews: isUserAuthenticated,
+    views: isUserPlaceOwner,
+    bookings: isUserPlaceOwner,
+  },
+  // Booking: isUserBookingOwner,
+})

src/permissions/rules.ts

@@ -0,0 +1,57 @@
+import { Context, getUserId } from '../utils'
+import { rule } from 'graphql-shield'
+
+export const isUserAuthenticated = rule({ cache: 'contextual' })(
+  async (parent, args, ctx: Context, info) => {
+    console.log('is auth')
+
+    const userId = getUserId(ctx)
+
+    return userId !== undefined
+  },
+)
+
+export const isUserSelf = rule({
+  cache: 'strict',
+  fragment: 'fragment UserID on User { id }',
+})(async ({ id }, args, ctx: Context, info) => {
+  console.log('is self')
+  const userId = getUserId(ctx)
+  return id === userId
+})
+
+export const isUserPaymentAccountOwner = rule({
+  cache: 'strict',
+  fragment: 'fragment PaymentAccountID on PaymentAccount { id }',
+})(async ({ id }, args, ctx: Context, info) => {
+  const userId = getUserId(ctx)
+  console.log('is payment account owner')
+  return ctx.db.exists.PaymentAccount({
+    id,
+    user: { id: userId },
+  })
+})
+
+export const isUserPlaceOwner = rule({
+  cache: 'strict',
+  fragment: 'fragment PlaceID on Place { id }',
+})(async ({ id }, args, ctx: Context, info) => {
+  console.log('is place owner')
+  const userId = getUserId(ctx)
+  return ctx.db.exists.Place({
+    id,
+    host: { id: userId },
+  })
+})
+
+export const isUserBookingOwner = rule({
+  cache: 'strict',
+  fragment: 'fragment BookingID on Booking { id }',
+})(async ({ id }, args, ctx: Context, info) => {
+  console.log('is booking owner')
+  const userId = getUserId(ctx)
+  return ctx.db.exists.Booking({
+    id,
+    bookee: { id: userId },
+  })
+})

src/schema.graphql

@@ -142,26 +142,32 @@ type ExperienceCategory {
 }
 
 type User {
-  bookings: [Booking!]
+  id: ID!
   createdAt: DateTime!
+  updatedAt: DateTime!
+
   email: String!
   firstName: String!
-  hostingExperiences: [Experience!]
-  id: ID!
-  isSuperHost: Boolean!
   lastName: String!
-  location: Location!
-  notifications: [Notification!]
-  ownedPlaces: [Place!]
-  paymentAccount: [PaymentAccount!]
   phone: String!
+  location: Location!
+
   profilePicture: Picture
-  receivedMessages: [Message!]
+  isSuperHost: Boolean!
+  paymentAccount: [PaymentAccount!]
+  token: String!
+
   responseRate: Float
   responseTime: Int
+
+  bookings: [Booking!]
+  hostingExperiences: [Experience!]
+  ownedPlaces: [Place!]
+
+  receivedMessages: [Message!]
   sentMessages: [Message!]
-  updatedAt: DateTime!
-  token: String!
+
+  notifications: [Notification!]
 }
 
 type PaymentAccount {
@@ -345,4 +351,4 @@ type Amenities {
   washer: Boolean!
   wheelchairAccessible: Boolean!
   wirelessInternet: Boolean!
-}
+}

yarn.lock

@@ -171,6 +171,10 @@ ansi-align@^2.0.0:
   dependencies:
     string-width "^2.0.0"
 
+ansi-escapes@^1.1.0:
+  version "1.4.0"
+  resolved "https://registry.yarnpkg.com/ansi-escapes/-/ansi-escapes-1.4.0.tgz#d3a8a83b319aa67793662b13e761c7911422306e"
+
 ansi-escapes@^3.0.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/ansi-escapes/-/ansi-escapes-3.1.0.tgz#f73207bb81207d75fd6c83f125af26eea378ca30"
@@ -469,7 +473,15 @@ aws4@^1.6.0:
   version "1.7.0"
   resolved "https://registry.yarnpkg.com/aws4/-/aws4-1.7.0.tgz#d4d0e9b9dbfca77bf08eeb0a8a471550fe39e289"
 
-babel-runtime@^6.25.0, babel-runtime@^6.26.0:
+babel-polyfill@6.23.0:
+  version "6.23.0"
+  resolved "https://registry.yarnpkg.com/babel-polyfill/-/babel-polyfill-6.23.0.tgz#8364ca62df8eafb830499f699177466c3b03499d"
+  dependencies:
+    babel-runtime "^6.22.0"
+    core-js "^2.4.0"
+    regenerator-runtime "^0.10.0"
+
+babel-runtime@^6.22.0, babel-runtime@^6.25.0, babel-runtime@^6.26.0:
   version "6.26.0"
   resolved "https://registry.yarnpkg.com/babel-runtime/-/babel-runtime-6.26.0.tgz#965c7058668e82b55d7bfe04ff2337bc8b5647fe"
   dependencies:
@@ -749,15 +761,7 @@ caw@^2.0.0:
     tunnel-agent "^0.6.0"
     url-to-options "^1.0.1"
 
-chalk@2.3.1:
-  version "2.3.1"
-  resolved "https://registry.yarnpkg.com/chalk/-/chalk-2.3.1.tgz#523fe2678aec7b04e8041909292fe8b17059b796"
-  dependencies:
-    ansi-styles "^3.2.0"
-    escape-string-regexp "^1.0.5"
-    supports-color "^5.2.0"
-
-chalk@^1.1.3:
+chalk@1.1.3, chalk@^1.0.0, chalk@^1.1.3:
   version "1.1.3"
   resolved "https://registry.yarnpkg.com/chalk/-/chalk-1.1.3.tgz#a8115c55e4a702fe4d150abd3872822a7e09fc98"
   dependencies:
@@ -767,6 +771,14 @@ chalk@^1.1.3:
     strip-ansi "^3.0.0"
     supports-color "^2.0.0"
 
+chalk@2.3.1:
+  version "2.3.1"
+  resolved "https://registry.yarnpkg.com/chalk/-/chalk-2.3.1.tgz#523fe2678aec7b04e8041909292fe8b17059b796"
+  dependencies:
+    ansi-styles "^3.2.0"
+    escape-string-regexp "^1.0.5"
+    supports-color "^5.2.0"
+
 chalk@^2.0.0, chalk@^2.0.1, chalk@^2.1.0, chalk@^2.3.0, chalk@^2.3.1:
   version "2.4.1"
   resolved "https://registry.yarnpkg.com/chalk/-/chalk-2.4.1.tgz#18c49ab16a037b6eb0152cc83e3471338215b66e"
@@ -1613,7 +1625,7 @@ extend@~3.0.1:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/extend/-/extend-3.0.1.tgz#a755ea7bc1adfcc5a31ce7e762dbaadc5e636444"
 
-external-editor@^2.0.4, external-editor@^2.1.0:
+external-editor@^2.0.1, external-editor@^2.0.4, external-editor@^2.1.0:
   version "2.2.0"
   resolved "https://registry.yarnpkg.com/external-editor/-/external-editor-2.2.0.tgz#045511cfd8d133f3846673d1047c154e214ad3d5"
   dependencies:
@@ -2251,6 +2263,13 @@ graphql-schema-linter@0.1.1:
     graphql "^0.13.0"
     lodash "^4.17.4"
 
+graphql-shield@3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/graphql-shield/-/graphql-shield-3.0.0.tgz#eacfcf4d9f05b7870186d94de03d86169d9a38ff"
+  dependencies:
+    object-hash "^1.3.0"
+    opencollective "1.0.3"
+
 graphql-static-binding@0.9.3:
   version "0.9.3"
   resolved "https://registry.yarnpkg.com/graphql-static-binding/-/graphql-static-binding-0.9.3.tgz#67a51ed2e720edda5a250898af037ebf9dac57cf"
@@ -2287,7 +2306,7 @@ graphql-tools@3.1.1, graphql-tools@^3.0.5:
     iterall "^1.1.3"
     uuid "^3.1.0"
 
-graphql-yoga@1.16.2:
+graphql-yoga@^1.16.2:
   version "1.16.2"
   resolved "https://registry.yarnpkg.com/graphql-yoga/-/graphql-yoga-1.16.2.tgz#083293a9cecab6283e883c5a482c5c920fa66585"
   dependencies:
@@ -2530,6 +2549,24 @@ ini@^1.3.4, ini@~1.3.0:
   version "1.3.5"
   resolved "https://registry.yarnpkg.com/ini/-/ini-1.3.5.tgz#eee25f56db1c9ec6085e0c22778083f596abf927"
 
+inquirer@3.0.6:
+  version "3.0.6"
+  resolved "https://registry.yarnpkg.com/inquirer/-/inquirer-3.0.6.tgz#e04aaa9d05b7a3cb9b0f407d04375f0447190347"
+  dependencies:
+    ansi-escapes "^1.1.0"
+    chalk "^1.0.0"
+    cli-cursor "^2.1.0"
+    cli-width "^2.0.0"
+    external-editor "^2.0.1"
+    figures "^2.0.0"
+    lodash "^4.3.0"
+    mute-stream "0.0.7"
+    run-async "^2.2.0"
+    rx "^4.1.0"
+    string-width "^2.0.0"
+    strip-ansi "^3.0.0"
+    through "^2.3.6"
+
 inquirer@5.1.0:
   version "5.1.0"
   resolved "https://registry.yarnpkg.com/inquirer/-/inquirer-5.1.0.tgz#19da508931892328abbbdd4c477f1efc65abfd67"
@@ -3389,7 +3426,7 @@ minimist@0.0.8:
   version "0.0.8"
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-0.0.8.tgz#857fcabfc3397d2625b8228262e86aa7a011b05d"
 
-minimist@^1.2.0:
+minimist@1.2.0, minimist@^1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.0.tgz#a35008b20f41383eec1fb914f4cd5df79a264284"
 
@@ -3493,6 +3530,13 @@ node-emoji@^1.4.1:
   dependencies:
     lodash.toarray "^4.4.0"
 
+node-fetch@1.6.3:
+  version "1.6.3"
+  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-1.6.3.tgz#dc234edd6489982d58e8f0db4f695029abcd8c04"
+  dependencies:
+    encoding "^0.1.11"
+    is-stream "^1.0.1"
+
 node-fetch@2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.0.0.tgz#982bba43ecd4f2922a29cc186a6bbb0bb73fcba6"
@@ -3673,6 +3717,10 @@ object-copy@^0.1.0:
     define-property "^0.2.5"
     kind-of "^3.0.3"
 
+object-hash@^1.3.0:
+  version "1.3.0"
+  resolved "https://registry.yarnpkg.com/object-hash/-/object-hash-1.3.0.tgz#76d9ba6ff113cf8efc0d996102851fe6723963e2"
+
 object-keys@^1.0.8:
   version "1.0.11"
   resolved "https://registry.yarnpkg.com/object-keys/-/object-keys-1.0.11.tgz#c54601778ad560f1142ce0e01bcca8b56d13426d"
@@ -3739,6 +3787,24 @@ open@0.0.5:
   version "0.0.5"
   resolved "https://registry.yarnpkg.com/open/-/open-0.0.5.tgz#42c3e18ec95466b6bf0dc42f3a2945c3f0cad8fc"
 
+opencollective@1.0.3:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/opencollective/-/opencollective-1.0.3.tgz#aee6372bc28144583690c3ca8daecfc120dd0ef1"
+  dependencies:
+    babel-polyfill "6.23.0"
+    chalk "1.1.3"
+    inquirer "3.0.6"
+    minimist "1.2.0"
+    node-fetch "1.6.3"
+    opn "4.0.2"
+
+opn@4.0.2:
+  version "4.0.2"
+  resolved "https://registry.yarnpkg.com/opn/-/opn-4.0.2.tgz#7abc22e644dff63b0a96d5ab7f2790c0f01abc95"
+  dependencies:
+    object-assign "^4.0.1"
+    pinkie-promise "^2.0.0"
+
 opn@^5.1.0, opn@^5.2.0:
   version "5.3.0"
   resolved "https://registry.yarnpkg.com/opn/-/opn-5.3.0.tgz#64871565c863875f052cfdf53d3e3cb5adb53b1c"
@@ -4431,6 +4497,10 @@ redeyed@~1.0.0:
   dependencies:
     esprima "~3.0.0"
 
+regenerator-runtime@^0.10.0:
+  version "0.10.5"
+  resolved "https://registry.yarnpkg.com/regenerator-runtime/-/regenerator-runtime-0.10.5.tgz#336c3efc1220adcedda2c9fab67b5a7955a33658"
+
 regenerator-runtime@^0.11.0, regenerator-runtime@^0.11.1:
   version "0.11.1"
   resolved "https://registry.yarnpkg.com/regenerator-runtime/-/regenerator-runtime-0.11.1.tgz#be05ad7f9bf7d22e056f9726cee5017fbf19e2e9"
@@ -4591,6 +4661,10 @@ rx-lite@*, rx-lite@^4.0.8:
   version "4.0.8"
   resolved "https://registry.yarnpkg.com/rx-lite/-/rx-lite-4.0.8.tgz#0b1e11af8bc44836f04a6407e92da42467b79444"
 
+rx@^4.1.0:
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/rx/-/rx-4.1.0.tgz#a5f13ff79ef3b740fe30aa803fb09f98805d4782"
+
 rxjs@^5.5.2:
   version "5.5.10"
   resolved "https://registry.yarnpkg.com/rxjs/-/rxjs-5.5.10.tgz#fde02d7a614f6c8683d0d1957827f492e09db045"