GraphQL

Casbin follows the recommended GraphQL authorization pattern by implementing authorization as a single source of truth: https://graphql.org/learn/authorization/. This means Casbin logic should sit between the GraphQL layer and your business logic.

// Casbin authorization logic lives inside postRepository
var postRepository = require('postRepository');

var postType = new GraphQLObjectType({
  name: 'Post',
  fields: {
    body: {
      type: GraphQLString,
      resolve: (post, args, context, { rootValue }) => {
        return postRepository.getBody(context.user, post);
      }
    }
  }
});

Available GraphQL Middlewares

Below is a complete list of Casbin GraphQL middlewares. Third-party middleware contributions are welcome—please let us know and we'll include them here.