GraphQL Authentication — Securing Your API with JWT and Context

const jwt = require('jsonwebtoken');
const { ApolloServer, AuthenticationError } = require('apollo-server');

const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: async ({ req }) => {
    // Get token from Authorization header
    const authHeader = req.headers.authorization || '';
    const token = authHeader.startsWith('Bearer ') 
      ? authHeader.slice(7) 
      : null;
    
    let user = null;
    
    if (token) {
      try {
        // Verify and decode the JWT
        const decoded = jwt.verify(token, JWT_SECRET);
        // Fetch user from database (ensures user still exists)
        user = await db.users.findById(decoded.userId);
      } catch (err) {
        // Token invalid or expired — user stays null
        // Do NOT throw here — let individual resolvers decide
        console.warn('Invalid token:', err.message);
      }
    }
    
    return {
      user,
      db,
      loaders: createLoaders(),
    };
  },
});

const { AuthenticationError, ForbiddenError } = require('apollo-server');

const resolvers = {
  Query: {
    myDevices: (parent, args, context) => {
      if (!context.user) {
        throw new AuthenticationError('You must be logged in');
      }
      return context.db.devices.findByUserId(context.user.id);
    },
    
    allDevices: (parent, args, context) => {
      if (!context.user) {
        throw new AuthenticationError('You must be logged in');
      }
      if (context.user.role !== 'ADMIN') {
        throw new ForbiddenError('Only admins can list all devices');
      }
      return context.db.devices.findAll();
    },
  },
  
  Device: {
    // Owner-only fields
    internalNotes: (parent, args, context) => {
      if (!context.user || parent.userId !== context.user.id) {
        return null; // Hide sensitive data from unauthorized users
      }
      return parent.internalNotes;
    },
  },
};

enum Role {
  ADMIN
  ANALYST
  VIEWER
}

directive @auth(requires: Role!) on FIELD_DEFINITION | OBJECT

type Threat {
  id: ID!
  name: String!
  severity: Severity!
  # Only admins can see internal notes
  internalNotes: String @auth(requires: ADMIN)
  # Analysts and admins can see analysis
  analysis: String @auth(requires: ANALYST)
}

type Query {
  threats: [Threat!]!
  sensitiveThreats: [Threat!]! @auth(requires: ANALYST)
}

const { mapSchema, getDirectives, MapperKind } = require('@graphql-tools/utils');

function authDirectiveTransformer(schema) {
  return mapSchema(schema, {
    [MapperKind.OBJECT_FIELD]: (fieldConfig) => {
      const authDirective = getDirectives(schema, fieldConfig)?.auth;
      if (!authDirective) return;
      
      const { requires } = authDirective;
      const originalResolver = fieldConfig.resolve || defaultFieldResolver;
      
      fieldConfig.resolve = (source, args, context, info) => {
        if (!context.user) {
          throw new AuthenticationError('Authentication required');
        }
        
        const roleHierarchy = { ADMIN: 3, ANALYST: 2, VIEWER: 1 };
        if ((roleHierarchy[context.user.role] || 0) < (roleHierarchy[requires] || 0)) {
          throw new ForbiddenError(`Requires ${requires} role`);
        }
        
        return originalResolver(source, args, context, info);
      };
    },
  });
}

const server = new ApolloServer({
  typeDefas,
  resolvers,
  schemaTransforms: [authDirectiveTransformer],
});

// Refresh token mutation
const resolvers = {
  Mutation: {
    refreshToken: async (_, { refreshToken }, context) => {
      try {
        const decoded = jwt.verify(refreshToken, JWT_REFRESH_SECRET);
        const user = await db.users.findById(decoded.userId);
        
        if (!user) {
          throw new AuthenticationError('User not found');
        }
        
        // Issue new access token
        const newToken = jwt.sign(
          { userId: user.id, role: user.role },
          JWT_SECRET,
          { expiresIn: '15m' }
        );
        
        return {
          token: newToken,
          user,
        };
      } catch (err) {
        throw new AuthenticationError('Invalid refresh token');
      }
    },
  },
};

const jwt = require('jsonwebtoken');
const jwksClient = require('jwks-rsa');

const client = jwksClient({ jwksUri: 'https://your-domain.auth0.com/.well-known/jwks.json' });

function getKey(header, callback) {
  client.getSigningKey(header.kid, (err, key) => {
    callback(null, key?.publicKey || key?.rsaPublicKey);
  });
}

const server = new ApolloServer({
  typeDefs,
  resolvers,
  context: async ({ req }) => {
    const token = req.headers.authorization?.split(' ')[1];
    if (!token) return { user: null };
    
    return new Promise((resolve) => {
      jwt.verify(token, getKey, { 
        algorithms: ['RS256'],
        audience: 'https://api.dodatech.com',
        issuer: 'https://your-domain.auth0.com/',
      }, (err, decoded) => {
        if (err) return resolve({ user: null });
        resolve({ user: decoded });
      });
    });
  },
});