Set all queries to private with @auth

[MrHephaestus]

How would I go about preventing my API from being query-able unless provided a valid token.

[amaster507 (Anthony Master)]

It is a pending feature request:

@michaelcompton

Yeah, this is a really nice idea. There’s a couple of other ‘global’ things that we have thought about throwing in - e.g. having a switch for ‘all queries/mutations are public unless I state otherwise in the rules’ vs ‘all queries/mutations require an authenticated JWT unless I explicitly open one up in a rule’.

@arijit can you make sure this discussion gets noted on the list of community features to pick up.

@arijit any update on these discussions?

[michaelcompton]

@pawan do we have enough eng resources to add some global auth switches in before 20.11.0 ? We could add a switch into the Dgraph.Authorization key that changes the behaviour of un-decorated types to be requires a JWT.

It’s possible to get the same behaviour by adding a rule like { rule: "{$isAuthenticated: {eq: \"True\"}}" } and arranging all JWTs to have that claim. But that then needs to be added for every type.

Feels like there is two valid approaches here - open by default, and closed by default.

[pawan (Pawan Rawal)]

@michaelcompton

We could add a switch into the Dgraph.Authorization key that changes the behaviour of un-decorated types to require a JWT.

Yeah, that sounds like a valid one. So we could check that the JWT is valid and only then allow you to perform actions. If there were auth rules then they would be applied on top of this. Marking it as accepted and will tackle it in the upcoming sprints.