GraphQL Authorization — Role-Based Access Control Patterns

// Role hierarchy — higher roles inherit lower role permissions
const ROLES = {
  VIEWER: 1,
  ANALYST: 2,
  ADMIN: 3,
};

function checkRole(user, requiredRole) {
  if (!user) throw new AuthenticationError('Not authenticated');
  if ((ROLES[user.role] || 0) < ROLES[requiredRole]) {
    throw new ForbiddenError(`Requires ${requiredRole} role`);
  }
}

const resolvers = {
  Mutation: {
    deleteThreat: (_, { id }, context) => {
      checkRole(context.user, 'ADMIN');
      return context.db.threats.delete(id);
    },
    
    investigateThreat: (_, { id }, context) => {
      checkRole(context.user, 'ANALYST'); // ANALYST or ADMIN
      return context.db.threats.investigate(id);
    },
  },
};

type User {
  id: ID!
  email: String!
  displayName: String!
  role: String!
  # Only the user themselves or admins can see these
  ssoToken: String
  apiKeys: [APIKey!]
  billingInfo: BillingInfo
  # Only admins
  lastLoginIp: String
  loginHistory: [LoginEvent!]
}

const resolvers = {
  User: {
    // Owner or admin access
    ssoToken: (parent, args, context) => {
      if (context.user?.id === parent.id || context.user?.role === 'ADMIN') {
        return parent.ssoToken;
      }
      return null; // Hide from unauthorized users
    },
    
    // Admin only
    loginHistory: (parent, args, context) => {
      if (context.user?.role !== 'ADMIN') {
        return null;
      }
      return parent.loginHistory;
    },
  },
};

// Users can only access their own data (unless admin)
const resolvers = {
  Query: {
    devices: (parent, args, context) => {
      if (!context.user) throw new AuthenticationError('Login required');
      
      if (context.user.role === 'ADMIN') {
        // Admins can see all devices
        if (args.userId) {
          return context.db.devices.findByUserId(args.userId);
        }
        return context.db.devices.findAll();
      }
      
      // Regular users see only their own devices
      return context.db.devices.findByUserId(context.user.id);
    },
    
    device: (parent, { id }, context) => {
      if (!context.user) throw new AuthenticationError('Login required');
      
      const device = context.db.devices.findById(id);
      if (!device) throw new UserInputError('Device not found');
      
      // Check ownership
      if (device.userId !== context.user.id && context.user.role !== 'ADMIN') {
        throw new ForbiddenError('You can only access your own devices');
      }
      
      return device;
    },
  },
};

const { Ability, AbilityBuilder } = require('@casl/ability');

// Define permissions based on user role
function defineAbilitiesFor(user) {
  const { can, cannot, build } = new AbilityBuilder(Ability);
  
  if (user.role === 'ADMIN') {
    can('manage', 'all'); // Full access
  } else if (user.role === 'ANALYST') {
    can('read', 'Threat');
    can('update', 'Threat', { status: 'OPEN' }); // Only open threats
    can('read', 'Device');
    cannot('delete', 'Threat');
    cannot('manage', 'User');
  } else if (user.role === 'VIEWER') {
    can('read', 'Threat', { severity: { $in: ['LOW', 'MEDIUM'] } }); // Limited visibility
    can('read', 'Device', { userId: user.id }); // Own devices only
  }
  
  return build();
}

// Resolver using CASL
const resolvers = {
  Query: {
    threats: (parent, args, context) => {
      const ability = defineAbilitiesFor(context.user);
      
      let threats = context.db.threats.findAll();
      
      // Filter based on permissions
      return threats.filter(threat => ability.can('read', threat));
    },
  },
};

const resolvers = {
  Threat: {
    // Conditionally expose fields based on permissions
    internalNotes: (parent, args, context) => {
      if (context.user?.role === 'ADMIN' || context.user?.role === 'ANALYST') {
        return parent.internalNotes;
      }
      return null; // VIEWERs don't see internal notes
    },
    
    // Alternative: return a typed result with visibility info
    visibility: (parent, args, context) => {
      return {
        level: context.user?.role || 'PUBLIC',
        canEdit: context.user?.role === 'ADMIN',
        canDelete: context.user?.role === 'ADMIN',
        canShare: context.user?.role === 'ANALYST' || context.user?.role === 'ADMIN',
      };
    },
  },
};