How to implement custom authorization decorators

[blevine]

The @authorization implementation in type-graphql assumes role-based authorization. That has come in very handy (thank you!), but I also have some more complex authorization policies that I'd also like to describe declaratively. I was thinking of something like:

@CustomAuthorize(() => {some predicate logic})

OR

@OtherCustomAuthorize(props) where props are passed to a registered auth function that expects something other than roles.

I'm not sure how I would go about implementing either of these without hacking type-graphql itself to, for example, add additional authChecker-like functions . It seems like I'd have to specify a map of authChecker functions where each function was related to the specific custom authorization annotation.

Thanks in advance for your advice.

[blevine]

Of course, a few minutes after posting this I came up with one possible implementation. Since @Authorized is generic, I could define a complex role type that would suffice for a number of different authorization polices. In my authChecker I could then do type checking or duck-type-checking (presence of one or more properties) to determine which policy code to delegate to.

Sound right? Or is there a better way?

[MichalLytek]

@blevine You can use the authChecker solution with passing functions as arguments to @Authorized().

The alternative solution would be to use custom method decorators and middlewares to pass functions as arguments into a generic function which will throw error or call next():
https://typegraphql.com/docs/custom-decorators.html#method-decorators

[blevine]

Thanks!