@auth directive status and security

Users GraphQL
7

I guess you are talking about triggers. Triggers do all this automatically. And, in your case, it would be like a custom trigger, which can fire some API requests too. At present, triggers don’t exist anywhere in dgraph.

But, I guess you could still do it by making an explicit query with custom fields. So, lets say you have this schema:

type User {
  id: ID!
  name: String!
  dob: DateTime
  roles: [Role]
  saveToAuthZero: AuthZeroAddResponse! @custom(http: {
        url: "https://auth0url/addUser"
        method: "POST"
        body: "{uid: $id, name: $name, dob: $dob}"
        mode: SINGLE
        forwardHeaders: ["Auth0-Token"]
  })
  updateInAuthZero: AuthZeroUpdateResponse! @custom(http: {
        url: "https://auth0url/updateUser/$id"
        method: "PUT"
        body: "{roles: $roles}"
        mode: SINGLE
        forwardHeaders: ["Auth0-Token"]
  })
}
type Role {
  id: ID!
  permission: Int!
  on: String!
  ...
}
type AuthZeroAddResponse { ... }
type AuthZeroUpdateResponse { ... }

Then, when you have saved a user in dgraph, you can query the custom field saveToAuthZero for that user, like this:

query {
  getUser(id: "0x3") {
    saveToAuthZero {
      ...
    }
  }
}

It would end up calling the specified Auth0 API with the specified body in custom directive. This is just an idea. Similarly, you could query the field updateInAuthZero when you want to update things in Auth0.
Notice, that while querying you can send a header named Auth0-Token to dgraph, which will be forwarded as-is to Auth0 servers. You would want to probably use that for sending your JWT to Auth0.

So, what I just showed above is like a manual trigger instead of automated triggers. If you want to trigger such things manually, then you can choose @custom for your use-case. Automated triggering is not possible at present.

I guess you can do it directly. You would just need to map the Auth0 response payload to the types in GraphQL schema. As, you can forward headers, there shouldn’t be any problem.

2 Likes