i updated the package and i was able to call that function and successfully do an alter operation on an alpha that is set up for securing alter operations !
That much is great! Will you correct the tag and make an official release soon?
However i was only able to succeed from node.js as the browser fails due to cors errors, reported here:
Guys, I think the auth part is fine from the client side (except maybe documentation), the main repo needs to add the allowed header…
Perhaps you could use an additional function for setting for X-CSRF-Token in the client (as this is already allowed by the backend) - but all this can also be done without specialized functions just by setting the headers when creating the clientStub:
const headers = {
['X-CSRF-Token']:X_USER_AUTH_TOKEN,
// ['X-Dgraph-AuthToken']:X_DGRAPH_AUTH_TOKEN, // this is not permitted by alpha cors - and does exactly the same as setAlphaAuthToken()
['X-Auth-Token']:X_USER_AUTH_TOKEN // this is allowed but doesn't do anything related to alter restriction - but can be used with GraphQL @auth rules
}
const newStub = await new DgraphClientStub(DGRAPH_URL,undefined,{headers})