@treedom/mercurius-auth-opa

Mercurius Auth OPA is a plugin for Mercurius that adds an Authentication and Authorization directive using Open Policy Agent

Made with ❤️ at  , join us in making a difference!

Usage

1import { opaAuthPlugin } from "@treedom/mercurius-auth-opa";
2import { opaAuthDirective } from "@treedom/mercurius-auth-opa/opaAuthDirective";
3
4const schema = `#graphql
5  ${opaAuthDirective}
6
7  type Query {
8    ping(message: String!): String! @opa(path: "my/opa/policy", options: { ... })
9  }`
10
11app.register(mercurius, {
12  schema,
13  resolvers: {
14    Query: {
15      ping: (source, args) => args.message,
16    },
17  },
18})
19
20app.register(opaAuthPlugin, {
21  opaEndpoint: 'https://my.opa.endpoint',
22})

OPA policy input

This plugin queries OPA providing the following properties as input

• headers the Fastify headers object
• parent the Mercurius parent object of the field/object which got queried
• args the Mercurius args object of the field/object which got queried
• options static untyped properties defined in the directive arguments (optional)

Example Rego Policy

Let's imagine a GraphQL server which accept requests authorized using JWTs containing the role property in their claims. The following Rego uses a hypotetical oidc.verify_token that validates the JWT signature and returns the token claims or false if the token is not valid.

1package my.opa.policy
2
3import rego.v1
4import data.oidc
5
6default allow := false
7
8allow if {
9    user := oidc.verify_token(input.headers.authorization)
10
11    user
12    user.role = "admin"
13}

Custom directive

The authorization directive can be customized registering a custom one in the schema and specifying its name in the plugin configuration

1scalar OpaOptions
2directive @policy(path: String!, options: OpaOptions) on OBJECT | FIELD_DEFINITION

1app.register(opaAuthPlugin, {
2  // ...
3  authDirective: 'policy'
4})

1app.register(opaAuthPlugin, {
2  // ...
3  opaOptions: {
4    // ...
5  }
6})

🌳 Join Us in Making a Difference! 🌳

We invite all developers who use Treedom's open-source code to support our mission of sustainability by planting a tree with us. By contributing to reforestation efforts, you help create a healthier planet and give back to the environment. Visit our Treedom Open Source Forest to plant your tree today and join our community of eco-conscious developers.

Additionally, you can integrate the Treedom GitHub badge into your repository to showcase the number of trees in your Treedom forest and encourage others to plant new ones. Check out our integration guide to get started.

Together, we can make a lasting impact! 🌍💚

Contributing

Contributions are welcome! Please read the contributing guidelines before submitting a pull request.

License

This project is licensed under the MIT License.