Understanding the critical parts of wiring custom directives

[johnboulder]

I'm working on a project that's already successfully generating a GraphQL schema from Kotlin in a Spring WebFlux environment. I've been tasked with writing a custom directive that uses authorization to conditionally show annotated fields, which seems like a pretty common use case from the discussion I've seen about it here. I found this conversation very helpful in confirming the direction I'm working in

I've managed to create a custom data fetcher, directive, and wiring, and publish it in a library. And when I use it in a project, I can plainly see in the generated schema that the directive is being included. But I can't see any proof that the custom DataFetcher is being executed. In an effort to make sure that it is, I've added logging to the DataFetcher and made it always return null for whatever field is using the directive. However, I never see log output, and the fields still return a valid value when I call the query.

What I think I'm struggling with is the fact that every example I've seen for writing a custom directive explicitly calls toSchema() in some way. If the project I'm working on generates its schema by specifying the graphql.packages property, and annotating the types, how should I change my project's configuration?

I've seen this example which specifies a number of different beans, but it's not clear which beans I need if I'm only trying to include a custom directive. Do I just need wiringFactory? Or wiringFactory and hooks specified?

Here's what I've setup.

Config

@Import(AccessCheckConfig::class)
@Configuration
open class AccessDirectiveConfig(private val accessCheckService: AccessCheckService) {

    @Bean
    open fun authContext() = AuthContext()

    @Bean
    open fun wiringFactory() = CustomDirectiveWiringFactory(accessCheckService, authContext())
}

CustomDirectiveWiringFactory

@Component
class CustomDirectiveWiringFactory(
    private val accessCheckService: AccessCheckService,
    private val authContext: AuthContext
) :
    KotlinDirectiveWiringFactory() {

    override fun getSchemaDirectiveWiring(environment: KotlinSchemaDirectiveEnvironment<GraphQLDirectiveContainer>): KotlinSchemaDirectiveWiring? =
        when (environment.directive.name) {
            getDirectiveName(UserRoleDirective::class) -> UserRoleDirectiveWiring(accessCheckService, authContext)
            else -> null
        }
}

internal fun getDirectiveName(kClass: KClass<out Annotation>): String =
    kClass.simpleName!!.replaceFirstChar { it.lowercase() }

Directive

@GraphQLDirective(
    name = "hasRole",
    description = "",
    locations = [FIELD_DEFINITION, FIELD]
)
annotation class UserRoleDirective(
    val role: String
)

@Component
class UserRoleDirectiveWiring(
    private val accessCheckService: AccessCheckService,
    private val authContext: AuthContext
) : KotlinSchemaDirectiveWiring {

    override fun onField(environment: KotlinFieldDirectiveEnvironment): GraphQLFieldDefinition {
        val field = environment.element
        val originalDataFetcher: DataFetcher<*> = environment.getDataFetcher()
        val roleDataFetcher = RoleDataFetcher(originalDataFetcher, environment, accessCheckService, authContext)
        environment.setDataFetcher(roleDataFetcher)
        return field
    }
}

DataFetcher

(Note, for testing purposes, that this is currently setup to always return a null value)

open class RoleDataFetcher(
    private val originalDataFetcher: DataFetcher<*>,
    private val directiveEnv: KotlinFieldDirectiveEnvironment,
    private val accessCheckService: AccessCheckService,
    private val authContext: AuthContext
) : DataFetcher<Any> {
    override fun get(environment: DataFetchingEnvironment): Any? {
        val logger = SystemEventLoggerFactory.getLogger(RoleDataFetcher::class)
        val token = authContext.token

        logger.logEvent(
            RoleDataFetcherEvent(
                message = "RoleDataFetcher has been run",
                loggingLevel = SystemEvent.Level.INFO
            )
        )

        // TODO get values passed to directive from directiveEnv to determine the necessary check
        val isAuthorized = runBlocking {
            try {
                accessCheck(token)
            } catch (e: Exception) {
                logger.logEventException(e)
                false
            }
        }

        return if (false) {
            originalDataFetcher.get(environment)
        } else {
            null
        }
    }
}

[dariuszkuc]

Hello 👋
By default, spring-server will instantiate the schema with no-op hooks so you will need to create a custom hooks bean that uses your custom wiring.

I've been tasked with writing a custom directive that uses authorization to conditionally show annotated fields

Do you mean conditionally resolve the fields? Then yeah, you could do that using the approach above with auth directives - I'd also recommend to make those fields nullable as otherwise attempting to fetch unauthorized field will blow up the whole query.

If you need to expose dynamic schema to the end user, i.e. so they don't even see the extra fields, then it gets a somewhat more complex. I'd assume you would need to create a custom spring server that has multiple GraphQL schemas corresponding to the user authentication state (e.g. anonymous read only, user with some additional fields, admin with all fields, etc) and route requests to the appropriate schema based on the user state. As for building multiple instances of schema -> you could start with a single admin one and then transform it to exclude fields (see field visibility). Note: we don't have a built-in mechanism for this scenario so you would need a custom server and implement custom GraphqlFieldVisibility transformers.