That’s so weird, @arijit, because my resources look identical to what you have here. Here’s a list of everything (some may be duplicated from earlier in the conversation but I’m including it here for a collected reference).
- I’m using the JSON-formatted config for the bottom of my
schema.graphl file - I’m building off of the
masterbranch for the Dgraph repo (git pulland then running themake installcommand) - I’m running Dgraph using
dgraph zero --my=localhost:5080anddgraph alpha --lru_mb=2048 --my=localhost:7080 --zero=localhost:5080on two separate tabs of my command line and then uploading the schema usingcurl -X POST localhost:8080/admin/schema -d '@schema.graphql' - the mutation I’m execution is identical (excepting different variable values)
- I’m not evaluating the
"Audience"parameter but that was marked as optional in the documentation - I’m following this documentation to generate the private key in the schema authorization configuration
- below is a collection of all of the resources I have in their current configuration
Schema (simplified):
type OwnerOrg implements Org & Location @auth(
add: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
]},
query: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ or: [
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
{ rule: "{ $role: { eq: \"USER_INTERNAL\" } }"},
]},
{ rule: """query($orgID: ID!) {
queryOwnerOrg( filter: { id: [$orgID] } ) {
id
}
}"""},
]},
update: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
{ rule: """query($orgID: ID!) {
queryOwnerOrg( filter: { id: [$orgID] } ) {
id
}
}"""},
]},
delete: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
{ rule: """query($orgID: ID!) {
queryOwnerOrg( filter: { id: [$orgID] } ) {
id
}
}"""},
]},
) {
labs: [LabOrg!]! @hasInverse(field: owner)
storages: [StorageOrg!]! @hasInverse(field: owner)
}
interface Org {
id: ID!
name: String! @search(by: [hash])
users: [User!]! @hasInverse(field: org)
createdOn: DateTime!
updatedOn: DateTime!
}
type User @auth(
add: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
{ rule: """query($orgID: ID!) {
queryUser {
owner( filter: { id: [$orgID] } ) {
id
}
}
}"""},
]},
query: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
{ rule: """query($orgID: ID!) {
queryUser {
owner( filter: { id: [$orgID] } ) {
id
}
}
}"""},
]},
update: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
{ rule: """query($orgID: ID!) {
queryUser {
owner( filter: { id: [$orgID] } ) {
id
}
}
}"""},
]},
delete: { and: [
{ rule: "{ $isAuthenticated: { eq: \"true\" } }" },
{ rule: "{ $role: { eq: \"USER_ADMIN\" } }"},
{ rule: """query($orgID: ID!) {
queryUser {
owner( filter: { id: [$orgID] } ) {
id
}
}
}"""},
]},
) {
owner: OwnerOrg!
email: String! @id
firstName: String! @search(by: [exact])
lastName: String! @search(by: [exact])
org: Org! @hasInverse(field: users)
user_id: String!
}
interface Location {
street: String! @search(by: [fulltext])
city: String! @search(by: [fulltext])
county: String! @search(by: [exact])
state: String! @search(by: [exact])
country: String! @search(by: [exact])
zip: Int! @search
}
# Dgraph.Authorization {"VerificationKey":"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt50KaKOwI1/r9yEojzVW\ncOwGTZbL7sjlUaSI25icLPF8eK1R2dbVaKTdZNtq6LAxFe+NDt2AuU7Vtqzv8GGv\nb2RP5KEgUcJyy75Yw0hT4TP3SrzDB2paCfcKHxQlTQ0pFP0SJMk4YCfq+gDqPnXQ\nCfzw+Zff29zZh5bs1lOxvAIgsu9LtH/zX6f5ASMdHV8EPWdZq6nq8KoOiMcAizDj\nrbm/qcAJP6k+ztbgtN6HdD8v6+7uIKStrYRa0BLXdJAra2uaLI4z2H22RHuzhkIu\nytxpYnxDlYTXzroSiRs/vs/dyHixT8smbEQmLoPTpflnoEZcNDXkhf0v9yVtG6NV\n1QIDAQAB\n-----END PUBLIC KEY-----","Header":"X-Auth0-Token","Namespace":"https://folivora.io/jwt/claims","Algo":"RS256"}
Auth0 Rule code:
function addAttributes(user, context, callback) {
const claims = {
"isAuthenticated": "true", // string because of dgraph requirement
"role": user.app_metadata.role,
"orgID": user.app_metadata.orgID
};
context.idToken["https://folivora.io/jwt/claims"] = claims;
callback(null, user, context);
}
JWT contents:
{
"https://folivora.io/jwt/claims": {
"isAuthenticated": "true",
"role": "USER_ADMIN",
"orgID": "42"
},
"nickname": "john.forstmeier",
...
}
Mutation:
{
"query": "mutation AddOwnerOrgs($input: [AddOwnerOrgInput!]!) { addOwnerOrg(input: $input) { ownerOrg { id } } }",
"variables": {
"input": [
{
"street": "street",
"city": "city",
"county": "county",
"state": "state",
"country": "country",
"zip": 12345,
"name": "name",
"users": [],
"createdOn": "2006-01-02T15:04:05",
"updatedOn": "2006-01-02T15:04:05",
"labs": [],
"storages": []
}
]
}
}
Header (token header is the token retrieved from the login process):
Sorry to keep harping on this particular issue - it’s just now become a full blocker on my end with being unable to use Dgraph @auth fully. The documentation and support here has been amazing I’m just not sure what I’m doing wrong. 