Apollo Server Federation with graphql-shield

Question

我在用graphql-shield保护一个subgraph。

const isAuthenticated = rule({ cache: 'contextual' })(async (parent, args, ctx, info) => {
  return ctx.isAuthenticated
})

const permissions = shield({
  Query: {
    '*': and(isAuthenticated)
  },
  Mutation: {
    '*': and(isAuthenticated)
  }
})

const server = new ApolloServer({
    schema: applyMiddleware(buildSubgraphSchema([{ typeDefs, resolvers }]), permissions),
    introspection: global.configuration.ENVIRONMENT === 'development'
})

在我的构建过程中，我使用rover CLI来更新Apollo Studio中的supergraph schema：

rover subgraph introspect http://localhost/graphql | rover subgraph publish super-graph@development --routing-url http://localhost/graphql --schema - --name persons

由于权限屏蔽抛出Not Authorised!错误，rover更新失败。

如何使用graphql-shield保护subgraph并允许SubgraphIntrospectQuery操作？

我知道可以在rover introspect命令中添加一个持有者令牌：

rover subgraph introspect http://localhost/graphql --header "Authorization: Bearer token"

但是，我无法在构建过程中生成访问令牌。

Answer 1

我能够通过更改身份验证的范围来解决此问题。

而不是验证所有的"*“

const permissions = shield({
  Query: {
    '*': and(isAuthenticated)
  },
  Mutation: {
    '*': and(isAuthenticated)
  }
})

我更改为对单个操作进行身份验证：

const permissions = shield({
  Query: {
    'user': and(isAuthenticated),
    'users': and(isAuthenticated)
    ....
  },
  Mutation: {
    'createUser': and(isAuthenticated),
    'updateUser': and(isAuthenticated)
    ....
  }
})