How to make `GraphqlFieldVisibility` work with WebFlux

[huahouye]

spring-boot 2.7.0-M1
spring-boot-starter-graphql 2.7.0-M1

@Bean
public RuntimeWiringConfigurer configurer(MyReactiveUserAccessService myReactiveUserAccessService) {
return (builder) -> builder.fieldVisibility(new PerFieldAuthorization(myReactiveUserAccessService));
}

class PerFieldAuthorization implements GraphqlFieldVisibility {

	private final MyReactiveUserAccessService myReactiveUserAccessService;

	public PerFieldAuthorization(MyReactiveUserAccessService myReactiveUserAccessService) {
		this.myReactiveUserAccessService = myReactiveUserAccessService;
	}

	@Override
	public List<GraphQLFieldDefinition> getFieldDefinitions(GraphQLFieldsContainer fieldsContainer) {
		return fieldsContainer.getFieldDefinitions();
	}

	@Override
	public GraphQLFieldDefinition getFieldDefinition(GraphQLFieldsContainer fieldsContainer, String fieldName) {
		myReactiveUserAccessService.getRoles().blockLast(); // Exception
		return fieldsContainer.getFieldDefinition(fieldName);
	}

	@Override
	public List<GraphQLInputObjectField> getFieldDefinitions(GraphQLInputFieldsContainer fieldsContainer) {
		return fieldsContainer.getFieldDefinitions();
	}

	@Override
	public GraphQLInputObjectField getFieldDefinition(GraphQLInputFieldsContainer fieldsContainer, String fieldName) {
		return fieldsContainer.getFieldDefinition(fieldName);
	}

}

@Component
class MyReactiveUserAccessService {
	public Flux<String> getRoles() {
//		Mono.deferContextual((contextView) -> {
//			return Mono.empty();
//		});
		return Flux.just("ROLE_USER", "ROLE_ADMIN");
	}
}

I am trying to use GraphqlFieldVisibility (field-visibility document is here) to perform per-field authorization. Is there a way to make GraphqlFieldVisibility work with WebFlux?

Thanks.

[rstoyanchev]

Thanks for raising this.

We propagate context to data fetchers and exception resolvers, but those have access to GraphQLContext unlike GraphqlFieldVisibility. The examples seem to assume ThreadLocal's.

I'm not entirely sure how we could solve this. It would not be unreasonable for GraphQL Java to provide access to the GraphQLContext from GraphqlFieldVisibility but that's only part of the way. The contract would also need to become asynchronous, i.e. not assume that this can be done synchronously. Then we could make Reactor context work.

For a workaround, one option is to instrument the validation phase to expose ThreadLocal context:

class MyInstrumentation extends SimpleInstrumentation {

	@Override
	public InstrumentationContext<List<ValidationError>> beginValidation(InstrumentationValidationParameters params) {
		SecurityContext securityContext = params.getGraphQLContext().get("securityContext");
		SecurityContextHolder.setContext(securityContext);
		return new SimpleInstrumentationContext<List<ValidationError>>() {

			@Override
			public void onCompleted(List<ValidationError> result, Throwable t) {
				SecurityContextHolder.clearContext();
			}
		};
	}
}

You would also need to insert the SecurityContext into the GraphQLContext with a WebInterceptor like this:

static class MyWebInterceptor implements WebInterceptor {

	@Override
	public Mono<WebOutput> intercept(WebInput webInput, WebInterceptorChain chain) {
		return ReactiveSecurityContextHolder.getContext().flatMap(securityContext -> {
			webInput.configureExecutionInput((input, builder) -> {
				input.getGraphQLContext().put("securityContext", securityContext);
				return input;
			});
			return chain.next(webInput);
		});
	}
}