Allow createUser to be authenticated/restricted only to the current user

[morgothulhu]

Scenario is self-served portal.

Any user can sign-in using Auth0, thus get their id_token.
Using https://jwt.io/, the encoded id_token can be modified, to alter the sub field
Then the createUser(authProvider: {auth0: {idToken: $idToken}} ... mutation can be invoked with the forged id_token.

Two possible solutions I see:

• allow 'authenticated' condition to allow matching user (as long as the proper Authentication Bearer idToken) is passed even if the row is not yet created in User
• replace auth0: {idToken} to use JWT (as mentioned here) to validate on graph.cool proper signature

[sorenbs]

Thanks for reporting this @morgothulhu

I will look into this today and get back to you.

[sorenbs]

This is resolved by validating the jwt. Thanks again @morgothulhu