How To Specify A Specific Schema to Resolver Middleware?

[drewgallagher]

Hello!

I want to create a middleware that runs only on our public schema so we can validate users' access to client data within a single file, as opposed to doing it per query/mutation's authorize method.

From the docs and my experience so far, it appears that HTTP Middleware within Laravel can have an alias and you can assign that easily in the middleware property of the graphql.php file.

However for Resolver Middleware I haven't found a way to alias it so I can add it to that configuration array.

Is there a way to add an alias to the Resolver Middleware and take this approach, or is there an alternative way to do this?

I want to avoid using an HTTP Middleware because the GraphQL components haven't been parsed yet at the HTTP Middleware level, so it would require duplicate and complicated parsing to maintain security while extracting the args and performing the validation.

[mfn]

I don't quite understand what you're saying. What's the exact issue with the alias and the resolver middleware?

Putting this aside, does the resolver middleware solve your problem?

You can define it on the global level (config key: graphql.execution_middleware) or per schema (config key: graphql.schemas.$schemaName.execution_middleware). They're not merged however.

[drewgallagher]

@mfn I also tried putting a Resolver Middleware file into the the execution_middleware array but I get an error

<?php

declare(strict_types=1);

namespace App\GraphQL\Middleware;

use App\Utils\Clients\ExternalClients\ExternalClientsUtil;
use Closure;
use GraphQL\Type\Definition\ResolveInfo;
use Illuminate\Support\Facades\Auth;
use Rebing\GraphQL\Support\Middleware;

/**
 * ExternalAccess Middleware
 *
 * This middleware checks if the current user has access to the client(s) data specified in the arguments.
 *
 * This covers the general cases where we pass client_id or client_ids in the args, and does it in a single place.
 *
 */
class ExternalAccess extends Middleware
{
    public function handle($root, array $args, $context, ?ResolveInfo $info = null, ?Closure $next = null)
    {
        $currentUser = Auth::user();

        if (!$currentUser) {
            throw new \Exception('ExternalAccessMiddleware: User is null');
        }
        if (isset($args['client_id'])) {
            ExternalClientsUtil::isClientUserAccess($args['client_id'], $currentUser);
        }
        if (isset($args['client_ids'])) {
            ExternalClientsUtil::validateIfUserHasAccessToClients($args['client_ids'], $currentUser);
        }
        return $next($root, $args, $context, $info);
    }
}

Maybe it's because Resolver Middleware cannot be applied at the schema level?

If not, I'm not sure how I can create the middleware I need.

I want to be able to access the parsed args after the query string has been processed from the initial request. This way I don't have to do custom parsing and risk missing edge cases that introduce security risks into our API (i.e malformed requests)

[drewgallagher]

If I cannot use a Resolver Middleware at the schema level, and I cannot use an HTTP middleware, I think the only other option is to use that Resolver Middleware for each query/mutation, and somehow figure out how to check for the schema within the args passed to it. If it's not the public schema then it will go to the next middleware

[drewgallagher]

Hey @mfn could you provide any examples of using the execution or resolver middleware at the schema level?

[mfn]

I in fact only have them on the schema level, an excerpt:

            // Laravel HTTP middleware
            'middleware' => [
                'web-graphql',
            ],

            // Which HTTP methods to support
            'method' => ['POST'],

            // An array of middlewares, overrides the global ones
            'execution_middleware' => [
                Rebing\GraphQL\Support\ExecutionMiddleware\ValidateOperationParamsMiddleware::class,

In my case web-graphql is a group defined in \App\Http\Kernel::$middlewareGroups

HTH

[drewgallagher]

Thanks @mfn!

The problem I'm having is I want to access the $args within the execution middleware, but they are not available.

So then I try to use the Resolver Middleware, but that doesn't have the schema name.

Without having to manually register the middleware for each mutation and query, I want for only public schema named queries/mutations to execute the middleware for checking if they have access.

Since the Execution Middleware runs after the Resolver Middleware, I cannot set the schema name and pass it to the Resolver middleware.

The only other option at the moment I think of is using a Laravel HTTP middleware to extract the schema name and pass then down the resolver middleware. This way I don't have to attach the resolver middleware to each new mutation/query or existing ones.