Skip to content

GraphQL: Replace homecooked Authorize logic with gem auth [RUN AS-IF-FOSS]

charlie ablett requested to merge 13984-graphql-auth into master

What does this MR do?

This MR replaces our homecooked auth with the gem provided framework.

We retain our handy declarative logic authorize :ability for type-authorisations so the developer API remains constant.

According to the graphql-ruby auth docs, there are 3 layers that can declare authorisation:

  • types (including Enumerations)
  • fields (and the resolvers and mutations that implement them)
  • arguments (We do not currently support this!)

I made the following changes:

  • Removed the Authorize instrumentation and its declarative use calls from the schema and GraphQL helper
  • Replaced authorized_resource? with gem method authorized?
  • Removed AuthorizeFieldService

Related Issues

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #13984 (closed)

Edited by Alex Kalderimis

Merge request reports