# @pothos/plugin-authz

> A Pothos plugin for applying GraphQL AuthZ rules to fields

Latest version **3.5.10** (published 2024-06-22) · ISC license · 12.4K weekly downloads

## Install

```sh
npm install @pothos/plugin-authz
pnpm add @pothos/plugin-authz
yarn add @pothos/plugin-authz
bun add @pothos/plugin-authz
```

## Health

**Score 65/100 (B)** — status: abandoned.

Positive: has types; esm support; no vulnerabilities; has provenance; high maintenance score; high quality score; growing popularity.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 3.5.10 |
| Published | 2024-06-22 |
| First published | 2022-01-25 |
| Weekly downloads | 12.4K |
| License | ISC |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 0 |
| Unpacked size | 27 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 2617 |
| Author | Michael Hayes |
| Keywords | pothos, graphql, auth, authz, authorization |

## Links

- npm: https://www.npmjs.com/package/@pothos/plugin-authz
- Repository: https://github.com/hayes/pothos
- Homepage: https://github.com/hayes/pothos#readme
- Issues: https://github.com/hayes/pothos/issues
- npm.io page: https://npm.io/package/@pothos/plugin-authz

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads
- [escher-request](https://npm.io/package/escher-request.md) — 545 weekly downloads

## Recent versions

- 3.5.10 (latest) — 2024-06-22
- 0.0.0-preview-20220225212244 (preview) — 2022-02-25
- 3.5.9 — 2024-04-05
- 3.5.8 — 2023-05-01
- 3.5.7 — 2022-10-28
- 3.5.6 — 2022-10-21
- 3.5.5 — 2022-10-21
- 3.5.4 — 2022-09-30
- 3.5.3 — 2022-09-30
- 3.5.2 — 2022-09-30
- 3.5.1 — 2022-09-29
- 3.5.0 — 2022-09-28
- 3.4.2 — 2022-09-27
- 3.4.1 — 2022-09-18
- 3.4.0 — 2022-09-03
- … 9 more at https://npm.io/package/@pothos/plugin-authz/versions

## README

# AuthZ plugin

This is a simple plugin for integrating with
[GraphQL AuthZ](https://github.com/AstrumU/graphql-authz)

For more details on GraphQL AuthZ see the official
[documentation here](https://github.com/AstrumU/graphql-authz)

## Usage

### Install

```bash
yarn add @pothos/plugin-authz
```

### Setup

```typescript
import AuthzPlugin from '@pothos/plugin-authz';

const builder = new SchemaBuilder<{
  AuthZRule: keyof typeof rules;
}>({
  plugins: [AuthzPlugin],
});
```

This plugin will add the rules to your schema, but you will still need to set up your server (or
execute function) to run the authorization checks. The implementation of this depends on how your
app is set up.

A simple example that just wraps the execute function might look like:

```typescript
import { execute } from 'graphql';
import { wrapExecuteFn } from '@graphql-authz/core';
import rules from './auth-rules';

const wrappedExecute = wrapExecuteFn(execute, { rules });
```

## Defining rules for fields

```typescript
builder.queryType({
  fields: (t) => ({
    users: t.field({
      type: [User],
      authz: {
        rules: ['IsAuthenticated'],
      },
      resolve: () => users,
    }),
  }),
});
```

## Defining rules for types

```typescript
const Post = builder.objectRef<IPost>('Post');

Post.implement({
  authz: {
    rules: ['CanReadPost'],
  },
  fields: (t) => ({
    id: t.exposeID('id'),
  }),
});
```

## Defining inline composite rules

```typescript
const Post = builder.objectRef<IPost>('Post');

Post.implement({
  authz: {
    compositeRules: [{ or: ['CanReadPost', 'IsAdmin'] }],
  },
  fields: (t) => ({
    id: t.exposeID('id'),
  }),
});
```

More details about composite rules are in the documentation of
[AuthZ](https://github.com/AstrumU/graphql-authz#inline-composition-rules)

---
_Source: https://npm.io/package/@pothos/plugin-authz · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._