npm package: @lyvly/graphql-compose-auth-middleware
Description: Provides middleware for custom authorization of graphql-compose queries
Author: Ray Parkar
Latest version: 1.0.1

# graphql-compose-auth-middleware
[![npm version](https://badge.fury.io/js/%40lyvly%2Fgraphql-compose-auth-middleware.svg)](https://badge.fury.io/js/%40lyvly%2Fgraphql-compose-auth-middleware)
![CircleCI](https://img.shields.io/circleci/build/github/lyvly-living/graphql-compose-auth-middleware/master?token=0ce03fa42de92e666ccf74b3331b355965bcae3a)

Provides custom middleware that can be used to authorize your services.

## Motivation
We use these authorizers everywhere to ensure that our various GraphQL resolvers can only be accessed by the correct people with the correct authorizers.
We thought it would be a good idea to expose these simple authorizers for you to gain inspiration from or to use in your project.

## Usage

To use this library, add the main authorize function as middleware to your resolver definition in the `schemaComposer` and then pick any of our authorizers or write your own that follows our spec!

_Note: `authorize()` currently works on a first past the post system, the first authorizer that succeeds will be the context used for the rest of that request, it is advisable to order your authorizers from least privilege to most privilege at this time`

Feel free to open a PR and suggest a better or different way of doing things!

Example usage of one of our authorizers here
```js
import { authorize, customScopeAuthorizer } from '@lyvly/graphql-compose-auth-middleware';

schemaComposer.Mutation.addFields({
  memberCreateOne: MemberTypeComposer.getResolver('memberCreateOne', [
    authorize([customScopeAuthorizer('yourScope')]),
  ]),
});
```

### Custom scope authorizer
The custom scope authorizer interrogates `context.claims.scope`, which is expected to be an array. It takes in a `scopeName` parameter for the scope you wish to allow access to your resolver.

```
customScope(scopeName)
```

### Filter By Claim Value authorizer
The filter by claim value authorizer interrogates `context.claims[claimName]`. If it exists, the claim value is passed down to the resolver via a filter argument with the `filterName` as the key for the filter.

```
filterByClaimValue(claimName, filterName)
```

### Group authorizer
The group filter interrogates `context.claims[claimName]`, which is expected to be an array. It then checks to see if the `groupName` is included within the above interrogated value.

```
group(claimName, groupName)
```

### Authorizer specification

Our spec is very simple, simply create a standard `graphql-compose` middleware function and utilise the data inside to determine whether someone is authorized or not. Then return an object with a property of the name `authorized` as a boolean, and if true the 4 `graphql-compose` arguments are required as well.

Pass that function to `authorize()` as shown in the example at the top and you should be good to go!

Take a peek at some of our authorizers if you want to see an example of passing parameters into the authorizer as well.

```
export const yourAuthorizer = (source, args, context, info) => {
  if (falseCondition) {
    return { authorized: false };
  }

  return {
    authorized: true,
    source,
    args,
    context,
    info,
  };
};
```