Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add subscription member decorator for GraphQL que… #623

Closed
wants to merge 2 commits into from

Conversation

jhonylucas74
Copy link
Collaborator

Purpose

Increase the info security of GraphQL to sensitive data.

Description

This change aims to modify how the subscriptions in GraphQL are exposed to the public. After these changes, the allSubscription query from GraphQL will check if the user is authenticated. We have 4 main changes here:

  • Any user not logged in will not be able to call any subscription query from GraphQL.
  • Super users can still access the data without restrictions.
  • A logged-in user can see only their own content related to the subscriptions.
  • If a user is not the owner of the subscription but is a subscriber to that subscription, they can still see it.

Checklist

  • I have reviewed the code changes.
  • I have tested the changes locally.
  • I have updated the documentation if needed.
  • I have added/modified tests to ensure the changes are valid.

Testing and evidence

User accessing their own subscription data:
https://github.com/basedosdados/backend/assets/5381250/fe921aee-9df5-4ab1-b6b1-61ef371c283e

User accessing others' subscription data:
https://github.com/basedosdados/backend/assets/5381250/842f2350-534d-4559-98c7-e7f12cdf5e21

Not logged-in user trying to access subscription data:
https://github.com/basedosdados/backend/assets/5381250/4e285c97-7212-4879-a127-f1b5d0b974ba

@jhonylucas74 jhonylucas74 force-pushed the fix/66965489/reduce-info-allsubscriptions branch from b6abfb8 to d8d88ec Compare June 25, 2024 14:00
@jhonylucas74 jhonylucas74 changed the title fix(subsscription): Add subscription member decorator for GraphQL que… fix: Add subscription member decorator for GraphQL que… Jun 25, 2024
@jhonylucas74 jhonylucas74 force-pushed the fix/66965489/reduce-info-allsubscriptions branch from db21514 to f5da23a Compare June 25, 2024 14:06
@jhonylucas74 jhonylucas74 self-assigned this Jun 25, 2024
@jhonylucas74 jhonylucas74 changed the title fix: Add subscription member decorator for GraphQL que… fix: add subscription member decorator for GraphQL que… Jun 25, 2024
@jhonylucas74 jhonylucas74 deleted the fix/66965489/reduce-info-allsubscriptions branch June 28, 2024 11:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant