feat: Move mutation authorization from GraphQL-level to service-level

.changeset/service-method-auth.md

@@ -0,0 +1,8 @@
+---
+'@baseplate-dev/project-builder-lib': patch
+'@baseplate-dev/project-builder-server': patch
+'@baseplate-dev/project-builder-web': patch
+'@baseplate-dev/fastify-generators': patch
+---
+
+Move mutation authorization from GraphQL-level to service-level, add compact grid-based role picker UI, filter system role from auth pickers, and hide disabled service methods from GraphQL mutations section

examples/blog-with-auth/apps/backend/baseplate/file-id-map.json

@@ -43,6 +43,7 @@
   "@baseplate-dev/fastify-generators#core/request-service-context:request-service-context": "src/utils/request-service-context.ts",
   "@baseplate-dev/fastify-generators#core/service-context:service-context": "src/utils/service-context.ts",
   "@baseplate-dev/fastify-generators#core/service-context:test-helper": "src/tests/helpers/service-context.test-helper.ts",
+  "@baseplate-dev/fastify-generators#core/service-file:prisma-data-service:Blog": "src/modules/blogs/services/blog.data-service.ts",
   "@baseplate-dev/fastify-generators#core/service-file:prisma-data-service:User": "src/modules/accounts/services/user.data-service.ts",
   "@baseplate-dev/fastify-generators#pothos/pothos-auth:field-authorize-global-types": "src/plugins/graphql/FieldAuthorizePlugin/global-types.ts",
   "@baseplate-dev/fastify-generators#pothos/pothos-auth:field-authorize-plugin": "src/plugins/graphql/FieldAuthorizePlugin/index.ts",
@@ -55,6 +56,7 @@
   "@baseplate-dev/fastify-generators#pothos/pothos-scalar:uuid": "src/modules/graphql/scalars/uuid.ts",
   "@baseplate-dev/fastify-generators#pothos/pothos-sentry:use-sentry": "src/plugins/graphql/use-sentry.ts",
   "@baseplate-dev/fastify-generators#pothos/pothos-types-file:model:3BNvsyfylc9c-object-type": "src/modules/accounts/schema/user-role.object-type.ts",
+  "@baseplate-dev/fastify-generators#pothos/pothos-types-file:model:h7nbXcuLcUmy-mutations": "src/modules/blogs/schema/blog.mutations.ts",
   "@baseplate-dev/fastify-generators#pothos/pothos-types-file:model:h7nbXcuLcUmy-object-type": "src/modules/blogs/schema/blog.object-type.ts",
   "@baseplate-dev/fastify-generators#pothos/pothos-types-file:model:h7nbXcuLcUmy-queries": "src/modules/blogs/schema/blog.queries.ts",
   "@baseplate-dev/fastify-generators#pothos/pothos-types-file:model:jZxZ8T0aLW5C-mutations": "src/modules/accounts/schema/user.mutations.ts",
@@ -75,6 +77,7 @@
   "@baseplate-dev/fastify-generators#prisma/data-utils:relation-helpers": "src/utils/data-operations/relation-helpers.ts",
   "@baseplate-dev/fastify-generators#prisma/data-utils:types": "src/utils/data-operations/types.ts",
   "@baseplate-dev/fastify-generators#prisma/prisma-authorizer-utils:utils-authorizers": "src/utils/authorizers.ts",
+  "@baseplate-dev/fastify-generators#prisma/prisma-model-authorizer:prisma-model-authorizer:Blog": "src/modules/blogs/authorizers/blog.authorizer.ts",
   "@baseplate-dev/fastify-generators#prisma/prisma-model-authorizer:prisma-model-authorizer:User": "src/modules/accounts/authorizers/user.authorizer.ts",
   "@baseplate-dev/fastify-generators#prisma/prisma:client": "src/generated/prisma/client.ts",
   "@baseplate-dev/fastify-generators#prisma/prisma:prisma-config": "prisma.config.ts",

examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/accounts/services/user.data-service.ts

@@ -48,6 +48,7 @@ export async function createUser<
     fields: userInputFields,
     input,
     context,
+    authorize: ['admin'],
   });
 
   return commitCreate(plan, {
@@ -80,6 +81,7 @@ export async function updateUser<
     input,
     context,
     loadExisting: () => prisma.user.findUniqueOrThrow({ where }),
+    authorize: ['admin'],
   });
 
   return commitUpdate(plan, {
@@ -115,5 +117,6 @@ export async function deleteUser<
       });
       return item;
     },
+    authorize: ['admin'],
   });
 }

examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/blogs/authorizers/blog.authorizer.ts

@@ -0,0 +1,9 @@
+import { prisma } from '@src/services/prisma.js';
+import { createModelAuthorizer } from '@src/utils/authorizers.js';
+
+export const blogAuthorizer = createModelAuthorizer({
+  model: 'blog',
+  idField: 'id',
+  getModelById: (id) => prisma.blog.findUnique({ where: { id } }),
+  roles: { owner: (ctx, model) => model.userId === ctx.auth.userId },
+});

examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/blogs/index.ts

@@ -1,6 +1,7 @@
 import { flattenAppModule } from '@src/utils/app-modules.js';
 
 /* TPL_IMPORTS:START */
+import './schema/blog.mutations.js';
 import './schema/blog.object-type.js';
 import './schema/blog.queries.js';
 /* TPL_IMPORTS:END */

examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/blogs/schema/blog.mutations.ts

@@ -0,0 +1,52 @@
+import { queryFromInfo } from '@pothos/plugin-prisma';
+
+import { builder } from '@src/plugins/graphql/builder.js';
+
+import {
+  blogUpdateSchema,
+  deleteBlog,
+  updateBlog,
+} from '../services/blog.data-service.js';
+import { blogObjectType } from './blog.object-type.js';
+
+const updateBlogDataInputType = builder
+  .inputType('UpdateBlogData', {
+    fields: (t) => ({ name: t.string(), userId: t.field({ type: 'Uuid' }) }),
+  })
+  .validate(blogUpdateSchema);
+
+builder.mutationField('updateBlog', (t) =>
+  t.fieldWithInputPayload({
+    input: {
+      id: t.input.field({ required: true, type: 'Uuid' }),
+      data: t.input.field({ required: true, type: updateBlogDataInputType }),
+    },
+    payload: { blog: t.payload.field({ type: blogObjectType }) },
+    authorize: ['public', 'user', 'system', 'admin'],
+    resolve: async (root, { input: { id, data } }, context, info) => {
+      const blog = await updateBlog({
+        where: { id },
+        data,
+        context,
+        query: queryFromInfo({ context, info, path: ['blog'] }),
+      });
+      return { blog };
+    },
+  }),
+);
+
+builder.mutationField('deleteBlog', (t) =>
+  t.fieldWithInputPayload({
+    input: { id: t.input.field({ required: true, type: 'Uuid' }) },
+    payload: { blog: t.payload.field({ type: blogObjectType }) },
+    authorize: ['public', 'user', 'system', 'admin'],
+    resolve: async (root, { input: { id } }, context, info) => {
+      const blog = await deleteBlog({
+        where: { id },
+        context,
+        query: queryFromInfo({ context, info, path: ['blog'] }),
+      });
+      return { blog };
+    },
+  }),
+);

examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/blogs/services/blog.data-service.ts

@@ -0,0 +1,86 @@
+import { z } from 'zod';
+
+import type {
+  GetPayload,
+  ModelQuery,
+} from '@src/utils/data-operations/prisma-types.js';
+import type {
+  DataDeleteInput,
+  DataUpdateInput,
+} from '@src/utils/data-operations/types.js';
+
+import { prisma } from '@src/services/prisma.js';
+import {
+  commitDelete,
+  commitUpdate,
+} from '@src/utils/data-operations/commit-operations.js';
+import { composeUpdate } from '@src/utils/data-operations/compose-operations.js';
+import { scalarField } from '@src/utils/data-operations/field-definitions.js';
+import { generateUpdateSchema } from '@src/utils/data-operations/field-utils.js';
+import { relationHelpers } from '@src/utils/data-operations/relation-helpers.js';
+
+import { blogAuthorizer } from '../authorizers/blog.authorizer.js';
+
+export const blogInputFields = {
+  name: scalarField(z.string()),
+  userId: scalarField(z.uuid()),
+};
+
+export const blogUpdateSchema = generateUpdateSchema(blogInputFields);
+
+export async function updateBlog<
+  TQueryArgs extends ModelQuery<'blog'> = ModelQuery<'blog'>,
+>({
+  where,
+  data: input,
+  query,
+  context,
+}: DataUpdateInput<'blog', typeof blogInputFields, TQueryArgs>): Promise<
+  GetPayload<'blog', TQueryArgs>
+> {
+  const plan = await composeUpdate({
+    model: 'blog',
+    fields: blogInputFields,
+    input,
+    context,
+    loadExisting: () => prisma.blog.findUniqueOrThrow({ where }),
+    authorize: ['admin', blogAuthorizer.roles.owner],
+  });
+
+  return commitUpdate(plan, {
+    query,
+    execute: async ({ tx, data: { userId, ...rest }, query }) => {
+      const item = await tx.blog.update({
+        where,
+        data: { ...rest, user: relationHelpers.connectUpdate({ id: userId }) },
+        ...query,
+      });
+      return item;
+    },
+  });
+}
+
+export async function deleteBlog<
+  TQueryArgs extends ModelQuery<'blog'> = ModelQuery<'blog'>,
+>({
+  where,
+  query,
+  context,
+}: DataDeleteInput<'blog', TQueryArgs>): Promise<
+  GetPayload<'blog', TQueryArgs>
+> {
+  return commitDelete({
+    model: 'blog',
+    query,
+    context,
+    execute: async ({ tx, query }) => {
+      const item = await tx.blog.delete({
+        where,
+        ...query,
+      });
+      return item;
+    },
+    authorize: ['admin', blogAuthorizer.roles.owner],
+    loadExisting: () => prisma.blog.findUniqueOrThrow({ where }),
+  });
+}

examples/blog-with-auth/apps/backend/schema.graphql

@@ -111,12 +111,12 @@ type Mutation {
 
 type Query {
   blog(id: Uuid!): Blog!
-  blogs: [Blog!]!
+  blogs(skip: Int, take: Int): [Blog!]!
 
   """Get the current user session"""
   currentUserSession: UserSessionPayload
   user(id: Uuid!): User!
-  users: [User!]!
+  users(skip: Int, take: Int): [User!]!
 
   """The currently authenticated user"""
   viewer: User

examples/blog-with-auth/apps/backend/src/modules/accounts/services/user.data-service.ts

@@ -48,6 +48,7 @@ export async function createUser<
     fields: userInputFields,
     input,
     context,
+    authorize: ['admin'],
   });
 
   return commitCreate(plan, {
@@ -80,6 +81,7 @@ export async function updateUser<
     input,
     context,
     loadExisting: () => prisma.user.findUniqueOrThrow({ where }),
+    authorize: ['admin'],
   });
 
   return commitUpdate(plan, {
@@ -115,5 +117,6 @@ export async function deleteUser<
       });
       return item;
     },
+    authorize: ['admin'],
   });
 }

examples/blog-with-auth/apps/backend/src/modules/blogs/authorizers/blog.authorizer.ts

@@ -0,0 +1,9 @@
+import { prisma } from '@src/services/prisma.js';
+import { createModelAuthorizer } from '@src/utils/authorizers.js';
+
+export const blogAuthorizer = createModelAuthorizer({
+  model: 'blog',
+  idField: 'id',
+  getModelById: (id) => prisma.blog.findUnique({ where: { id } }),
+  roles: { owner: (ctx, model) => model.userId === ctx.auth.userId },
+});

examples/blog-with-auth/apps/backend/src/modules/blogs/index.ts

@@ -1,6 +1,7 @@
 import { flattenAppModule } from '@src/utils/app-modules.js';
 
 /* TPL_IMPORTS:START */
+import './schema/blog.mutations.js';
 import './schema/blog.object-type.js';
 import './schema/blog.queries.js';
 /* TPL_IMPORTS:END */

examples/blog-with-auth/apps/backend/src/modules/blogs/schema/blog.mutations.ts

@@ -0,0 +1,52 @@
+import { queryFromInfo } from '@pothos/plugin-prisma';
+
+import { builder } from '@src/plugins/graphql/builder.js';
+
+import {
+  blogUpdateSchema,
+  deleteBlog,
+  updateBlog,
+} from '../services/blog.data-service.js';
+import { blogObjectType } from './blog.object-type.js';
+
+const updateBlogDataInputType = builder
+  .inputType('UpdateBlogData', {
+    fields: (t) => ({ name: t.string(), userId: t.field({ type: 'Uuid' }) }),
+  })
+  .validate(blogUpdateSchema);
+
+builder.mutationField('updateBlog', (t) =>
+  t.fieldWithInputPayload({
+    input: {
+      id: t.input.field({ required: true, type: 'Uuid' }),
+      data: t.input.field({ required: true, type: updateBlogDataInputType }),
+    },
+    payload: { blog: t.payload.field({ type: blogObjectType }) },
+    authorize: ['public', 'user', 'system', 'admin'],
+    resolve: async (root, { input: { id, data } }, context, info) => {
+      const blog = await updateBlog({
+        where: { id },
+        data,
+        context,
+        query: queryFromInfo({ context, info, path: ['blog'] }),
+      });
+      return { blog };
+    },
+  }),
+);
+
+builder.mutationField('deleteBlog', (t) =>
+  t.fieldWithInputPayload({
+    input: { id: t.input.field({ required: true, type: 'Uuid' }) },
+    payload: { blog: t.payload.field({ type: blogObjectType }) },
+    authorize: ['public', 'user', 'system', 'admin'],
+    resolve: async (root, { input: { id } }, context, info) => {
+      const blog = await deleteBlog({
+        where: { id },
+        context,
+        query: queryFromInfo({ context, info, path: ['blog'] }),
+      });
+      return { blog };
+    },
+  }),
+);