Context setup (withAuth)
Relevant source files
The following files were used as context for generating this wiki page:
context.withAuth is a utility injected into the GraphQL context via the makeListConstraintMiddleware. It applies declarative authorization rules defined in the Prisma schema to individual Prisma queries. This mechanism ensures that data access constraints are enforced consistently at the model level rather than manually within every resolver.
Sources: README.md:105-111, src/makeListConstraintMiddleware.ts:25-27
Architecture and Data Flow
The withAuth function acts as a wrapper for Prisma query arguments. It merges the developer's query parameters with security-enforced where and select clauses.
Middleware Initialization
When the GraphQL schema is initialized with makeAuthorizationMiddlewares, the makeListConstraintMiddleware is registered. As a request enters a resolver, this middleware initializes a PrismaSelect instance and attaches the withAuth function to the context.
Sources: src/index.ts:37-41, src/makeListConstraintMiddleware.ts:40-42
Logic Flow Diagram
The following diagram illustrates how withAuth processes a Prisma query within a resolver.
The withAuth function determines which constraints to apply based on the arguments provided by the developer.
Sources: src/makeListConstraintMiddleware.ts:44-63
Core Functionality
The withAuth function handles three primary scenarios based on the path and type arguments provided.
Configuration Scenarios
| Scenario | Path | Type | Behavior |
|---|---|---|---|
| Root Return Type | Empty | Empty | Applies constraints based on the resolver's primary return type. |
| Nested Path | "path.to.field" | "ModelName" | Extracts specific constraints for a nested relation within the return type. |
| Arbitrary Type | undefined | "ModelName" | Generates ONLY a where clause for the specified model (no select). |
Sources: README.md:113-140, src/makeListConstraintMiddleware.ts:47-60
Parameter Enforcement
The utility uses PrismaSelect.mergeDeep to combine the user's query with authorization constraints. The authorization constraints are set last to ensure they cannot be overridden by user-provided query parameters.
Sources: src/makeListConstraintMiddleware.ts:62-63, src/select.test.ts:98-106
Implementation Details
The withAuth function is defined within the makeListConstraintMiddleware. It leverages the PrismaSelect class to parse the GraphQL info object and determine required fields and filters.
Query Merging
PrismaSelect.mergeDeep is the engine that combines objects. It includes protections against prototype pollution by blocking dangerous keys like __proto__, constructor, and prototype.
Sources: src/select.ts:133-145, src/select.test.ts:7-60
Security Constraints
Constraints are derived from the @Auth annotations in the Prisma schema.
- Where Clauses: Generated by
getListWhereConstrainsusing the roles defined for the model. - Select Clauses: Generated by
PrismaSelectto include all fields requested by the GraphQL query PLUS any dependency fields required by role matchers.
Sources: src/getListWhereConstrains.ts:35-65, src/select.ts:245-255
Example Usage
// In a resolver
resolve: async (parent, args, context) => {
// withAuth merges security rules into the findMany arguments
return context.prisma.purchases.findMany(context.withAuth({
where: { status: 'COMPLETED' }
}))
}
Sources: README.md:105-111
Summary
context.withAuth centralizes authorization logic within the Prisma query lifecycle. By injecting this utility into the context, the system forces developers to acknowledge model-level constraints while simplifying the implementation of secure resolvers. It effectively bridges the gap between GraphQL schema requirements and Prisma ORM queries, ensuring that sensitive relations and fields are never exposed unintentionally.
Sources: README.md:5-15, src/makeListConstraintMiddleware.ts:8-23