You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/authorization.rst
+24-10Lines changed: 24 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ Let's use a simple example model.
20
20
Limiting Field Access
21
21
---------------------
22
22
23
-
This is easy, simply use the ``only_fields`` meta attribute.
23
+
To limit fields in a GraphQL query simply use the ``only_fields`` meta attribute.
24
24
25
25
.. code:: python
26
26
@@ -63,8 +63,9 @@ define a resolve method for that field and return the desired queryset.
63
63
classQuery(ObjectType):
64
64
all_posts = DjangoFilterConnectionField(PostNode)
65
65
66
-
defresolve_all_posts(self, args, info):
67
-
return Post.objects.filter(published=True)
66
+
defresolve_all_posts(self, info):
67
+
return Post.objects.filter(published=True)
68
+
68
69
69
70
User-based Queryset Filtering
70
71
-----------------------------
@@ -95,7 +96,7 @@ schema is simple.
95
96
96
97
result = schema.execute(query, context_value=request)
97
98
98
-
Filtering ID-based node access
99
+
Filtering ID-based Node Access
99
100
------------------------------
100
101
101
102
In order to add authorization to id-based node access, we need to add a
@@ -113,37 +114,50 @@ method to your ``DjangoObjectType``.
113
114
interfaces = (relay.Node, )
114
115
115
116
@classmethod
116
-
defget_node(cls, id, context, info):
117
+
defget_node(cls, id, info):
117
118
try:
118
119
post =cls._meta.model.objects.get(id=id)
119
120
exceptcls._meta.model.DoesNotExist:
120
121
returnNone
121
122
122
-
if post.published or context.user == post.owner:
123
+
if post.published orinfo.context.user == post.owner:
123
124
return post
124
125
returnNone
125
126
126
-
Adding login required
127
+
128
+
Adding Login Required
127
129
---------------------
128
130
129
-
If you want to use the standard Django LoginRequiredMixin_ you can create your own view, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``:
131
+
To restrict users from accessing the GraphQL API page the standard Django LoginRequiredMixin_ can be used to create your own standard Django Class Based View, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``.:
130
132
131
133
.. code:: python
132
-
134
+
#views.py
135
+
133
136
from django.contrib.auth.mixins import LoginRequiredMixin
0 commit comments