graphql-shield

import { GraphQLServer } from 'graphql-yoga'; import { shield, rule, allow, deny, and, or } from 'graphql-shield'; const isAuthenticated = rule({ cache: 'contextual' })(async (parent, args, ctx, info) => { return ctx.user !== null; }); const isAdmin = rule({ cache: 'contextual' })(async (parent, args, ctx, info) => { return ctx.user?.roles.includes('admin'); }); const permissions = shield({ Query: { '*': isAuthenticated, // All queries require authentication user: or(isAuthenticated, isAdmin), // Example: user query specifically allows admin or authenticated adminPanel: isAdmin, }, Mutation: { createUser: and(isAuthenticated, isAdmin), updateUser: isAuthenticated, deleteUser: deny, }, // You can also define object type level rules User: { email: isAuthenticated, roles: isAdmin } }); const typeDefs = ` type User { id: ID! name: String! email: String roles: [String] } type Query { hello: String! user(id: ID!): User adminPanel: String! } type Mutation { createUser(name: String!, email: String!): User updateUser(id: ID!, name: String): User deleteUser(id: ID!): Boolean } `; const resolvers = { Query: { hello: () => 'Hello world!', user: (parent: any, { id }: { id: string }, ctx: any) => ({ id, name: `User ${id}`, email: `user${id}@example.com`, roles: ['user'] }), adminPanel: () => 'Welcome to the admin panel!' }, Mutation: { createUser: (parent: any, args: any) => ({ id: '1', ...args, roles: ['user'] }), updateUser: (parent: any, args: any) => ({ id: args.id, name: args.name || 'Updated User', email: 'updated@example.com', roles: ['user'] }), deleteUser: () => true, } }; // @ts-ignore - GraphQL Yoga handles middleware application const server = new GraphQLServer({ typeDefs, resolvers, context: ({ request }) => ({ user: request.headers['authorization'] === 'Bearer admin' ? { id: 'admin', roles: ['admin'] } : { id: 'test', roles: ['user'] } }) }); server.start(() => console.log('Server is running on http://localhost:4000'));