diff --git a/wiki/content/graphql/authorization/directive.md b/wiki/content/graphql/authorization/directive.md index 0e84a8faca4..744c412f08e 100644 --- a/wiki/content/graphql/authorization/directive.md +++ b/wiki/content/graphql/authorization/directive.md @@ -27,15 +27,17 @@ type Todo @auth( ){ id: ID! text: String! @search(by: [term]) - owner: String! + owner: String! @search(by: [hash]) } ``` +In addition to it, details of the authentication provider should be given in the last line of the schema, as discussed in section [authorization-overview](/graphql/authorization/authorization-overview). + Here we define a type `Todo`, that's got an `id`, the `text` of the todo and the username of the `owner` of the todo. What todos can a user query? Any `Todo` that the `query` rule would also return. The `query` rule in this case expects the JWT to contain a claim `"USER": "..."` giving the username of the logged in user, and says: you can query any todo that has your username as the owner. -In this example we use the `queryTodo` query that will be auto generated after uploading this schema. When using a query in a rule, you can only use the `queryTypeName` query. Where `TypeName` matches the name of where the `@auth` directive is attached. In other words, we could not have used the `getTodo` query in our rule above to query by id only. +In this example we use the `queryTodo` query that will be auto generated after uploading this schema. When using a query in a rule, you can only use the `queryTypeName` query. Where `TypeName` matches the name of the type, where the `@auth` directive is attached. In other words, we could not have used the `getTodo` query in our rule above to query by id only. This rule is applied automatically at query time. For example, the query diff --git a/wiki/content/graphql/authorization/mutations.md b/wiki/content/graphql/authorization/mutations.md index 9ad219712ab..a8c4b6acd78 100644 --- a/wiki/content/graphql/authorization/mutations.md +++ b/wiki/content/graphql/authorization/mutations.md @@ -24,12 +24,11 @@ type Todo @auth( } }""" } -){{ +){ id: ID! text: String! owner: User } - type User { username: String! @id todos: [Todo] @@ -58,7 +57,7 @@ type Todo @auth( }, { rule: "{$ROLE: { eq: \"ADMIN\" } }"} ]} -){{ +){ id: ID! text: String! @search(by: [term]) owner: User