可以通过石墨烯和SQLalchemy为GraphQL设置权限

Question

I have Clients, Users, Projects and Trips on my graphene schema:

class Clients(SQLAlchemyObjectType):
    class Meta:
        model = ClientModel
        interfaces = (relay.Node, )

class Users(SQLAlchemyObjectType):
    class Meta:
        model = UserModel
        interfaces = (relay.Node, )

class Projects(SQLAlchemyObjectType):
    class Meta:
        model = ProjectModel
        interfaces = (relay.Node, )

class Trips(SQLAlchemyObjectType):
    class Meta:
        model = TripModel
        interfaces = (relay.Node, )

What I want to do is to setup permissions so someone pass an access token that matches one specific Client, and shows only the users, projects and trips of that specific Client.

How to do this? Is there a method on graphene to do this?

Answer 1

I did it with flask_httpauth :

from flask_httpauth import HTTPTokenAuth
@auth.verify_token
def verify_token(token):
    for client in ClientModel.query.all():
        if client.access_token == token:
            g.current_user = client
            return True
    return False

Then I just put the login_required decorator on every resolve_ function on my Query class, like this:

@auth.login_required
    def resolve_clients(self, info):
        current_client = g.current_user
        for client in ClientModel.query.all():
            if client.id == current_client.id:
                return client
        return None