graphql-authz
GraphQL-Authz is a Python3.6+ port of GraphQL-Authz, the node.js implementation for the Casbin authorization middleware.
This package should use with GraphQL-core 3, allowing to limit access to each endpoint using casbin policy.
Installation
Install the package using pip.
pip install graphql-authz
Get Started
This package should use with graphql and graphql-middleware. To limit access to each graphql resource you can use a casbin policy. For example, given this policy for an RBAC model:
p, authorized_user, hello, query
Validation can be enforced using:
import casbin
from authz.middleware import enforcer_middleware
from graphql import (
graphql_sync,
GraphQLSchema,
GraphQLObjectType,
GraphQLField,
GraphQLString,
)
schema = GraphQLSchema(
query=GraphQLObjectType(
name="RootQueryType",
fields={
"hello": GraphQLField(
GraphQLString,
resolve=lambda obj, info: "world")
}))
enforcer = casbin.Enforcer("model_file.conf", "policy_file.csv")
casbin_middleware = enforcer_middleware(enforcer)
query = """{ hello }"""
# Authorized user ("authorized_user") has access to data
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "authorized_user"}
)
assert response.data == {"hello": "world"}
# Unauthorized users ("unauthorized_user") are rejected
response = graphql_sync(
schema,
query,
middleware=[casbin_middleware],
context_value={"role": "unauthorized_user"}
)
assert response.errors[0].message == "unauthorized_user can not query hello"
For more interesting scenarios see tests folder.
Credits
This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.
1.9k Jan 1, 2023
1.3k Dec 31, 2022
839 Dec 31, 2022
301 Dec 9, 2022
2.8k Jan 1, 2023
64 Feb 19, 2022
76 Dec 28, 2022
1 Nov 18, 2021
20 Feb 08, 2022
10 Jun 05, 2022
19 Jun 29, 2022
3 Jan 02, 2022
3 May 17, 2022
9 Nov 25, 2022
1.4k Dec 29, 2022
2 Dec 30, 2021
1 Oct 27, 2021
7 Dec 20, 2021
89 Dec 28, 2022