protected graphql

Eomm · Eomm · commit db1195dbc555 · 2019-08-08T22:07:25.000+02:00
diff --git a/auth-graphql/auth-gql.js b/auth-graphql/auth-gql.js
@@ -4,6 +4,9 @@ const GQL = require('fastify-gql')
 const JWT = require('fastify-jwt')
 
 function plugin (instance, options, next) {
+  /**
+   * Authentication settings
+   */
   instance.register(JWT, {
     secret: 'supersecret'
   })
@@ -16,42 +19,46 @@ function plugin (instance, options, next) {
 
   instance.decorate('authenticate', async function (request, reply) {
     try {
+      // Autorization logic
       await request.jwtVerify()
     } catch (err) {
       reply.send(err)
     }
   })
 
+  instance.addHook('onRoute', (routeOptions) => {
+    if (routeOptions.url === '/graphql') {
+      routeOptions.preValidation = [instance.authenticate]
+    }
+  })
+
+  /**
+   * GraphQL Stuff
+   */
   const schema = `
-  type Query {
-    add(x: Int, y: Int): Int
-  }
-`
+    type Query {
+      add(x: Int, y: Int): Int
+    }
+  `
 
   const resolvers = {
     Query: {
       add: async (_, { x, y }) => x + y
     }
   }
 
+  // A protected /graphql endpoint is exposed
   instance.register(GQL, {
     schema,
     resolvers
   })
 
+  // I can use the graphql also without authentication
   instance.get('/public', async function (req, reply) {
     const query = '{ add(x: 2, y: 2) }'
     return reply.graphql(query)
   })
 
-  instance.get('/private',
-    {
-      preValidation: [instance.authenticate]
-    }, async function (req, reply) {
-      const query = '{ add(x: 5, y: 5) }'
-      return reply.graphql(query)
-    })
-
   next()
 }
 
diff --git a/auth-graphql/package.json b/auth-graphql/package.json
@@ -8,9 +8,9 @@
     "lint": "standard",
     "lint:fix": "standard --fix",
     "try-me:public": "curl http://localhost:3000/public",
-    "try-me:private": "curl http://localhost:3000/private",
+    "try-me:private": "curl -X POST http://localhost:3000/graphql -H 'Content-Type: application/json' -H 'Authorization: Bearer ${JWT_TOKEN}' -d '{\"query\": \"{ add(x: 2, y: 2) }\" }'",
     "try-me:login": "JWT_TOKEN=$(curl -X POST http://localhost:3000/login) && echo ${JWT_TOKEN}",
-    "try-me:private:login": "JWT_TOKEN=$(curl -X POST http://localhost:3000/login) && echo ${JWT_TOKEN} && curl http://localhost:3000/private -H \"Authorization: Bearer ${JWT_TOKEN}\"",
+    "try-me:private:login": "npm run try-me:login && try-me:private",
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "keywords": [],
