Skip to content

Commit f6dba39

Browse files
authored
Merge pull request #506 from ccsv/patch-1
Update authorization docs to Graphene 2.0
2 parents 21bad61 + 2ccd483 commit f6dba39

File tree

1 file changed

+24
-10
lines changed

1 file changed

+24
-10
lines changed

docs/authorization.rst

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Let's use a simple example model.
2020
Limiting Field Access
2121
---------------------
2222

23-
This is easy, simply use the ``only_fields`` meta attribute.
23+
To limit fields in a GraphQL query simply use the ``only_fields`` meta attribute.
2424

2525
.. code:: python
2626
@@ -63,8 +63,9 @@ define a resolve method for that field and return the desired queryset.
6363
class Query(ObjectType):
6464
all_posts = DjangoFilterConnectionField(PostNode)
6565
66-
def resolve_all_posts(self, args, info):
67-
return Post.objects.filter(published=True)
66+
def resolve_all_posts(self, info):
67+
return Post.objects.filter(published=True)
68+
6869
6970
User-based Queryset Filtering
7071
-----------------------------
@@ -95,7 +96,7 @@ schema is simple.
9596
9697
result = schema.execute(query, context_value=request)
9798
98-
Filtering ID-based node access
99+
Filtering ID-based Node Access
99100
------------------------------
100101

101102
In order to add authorization to id-based node access, we need to add a
@@ -113,37 +114,50 @@ method to your ``DjangoObjectType``.
113114
interfaces = (relay.Node, )
114115
115116
@classmethod
116-
def get_node(cls, id, context, info):
117+
def get_node(cls, id, info):
117118
try:
118119
post = cls._meta.model.objects.get(id=id)
119120
except cls._meta.model.DoesNotExist:
120121
return None
121122
122-
if post.published or context.user == post.owner:
123+
if post.published or info.context.user == post.owner:
123124
return post
124125
return None
125126
126-
Adding login required
127+
128+
Adding Login Required
127129
---------------------
128130

129-
If you want to use the standard Django LoginRequiredMixin_ you can create your own view, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``:
131+
To restrict users from accessing the GraphQL API page the standard Django LoginRequiredMixin_ can be used to create your own standard Django Class Based View, which includes the ``LoginRequiredMixin`` and subclasses the ``GraphQLView``.:
130132

131133
.. code:: python
132-
134+
#views.py
135+
133136
from django.contrib.auth.mixins import LoginRequiredMixin
134137
from graphene_django.views import GraphQLView
135138
136139
137140
class PrivateGraphQLView(LoginRequiredMixin, GraphQLView):
138141
pass
139142
140-
After this, you can use the new ``PrivateGraphQLView`` in ``urls.py``:
143+
After this, you can use the new ``PrivateGraphQLView`` in the project's URL Configuration file ``url.py``:
144+
145+
For Django 1.9 and below:
141146

142147
.. code:: python
143148
144149
urlpatterns = [
145150
# some other urls
146151
url(r'^graphql', PrivateGraphQLView.as_view(graphiql=True, schema=schema)),
147152
]
153+
154+
For Django 2.0 and above:
155+
156+
.. code:: python
157+
158+
urlpatterns = [
159+
# some other urls
160+
path('graphql', PrivateGraphQLView.as_view(graphiql=True, schema=schema)),
161+
]
148162
149163
.. _LoginRequiredMixin: https://docs.djangoproject.com/en/1.10/topics/auth/default/#the-loginrequired-mixin

0 commit comments

Comments
 (0)