Demo GraphQL

This project showcases using Cerbos inside of a GraphQL server. The server is written in typescript and makes used of type-graphql to create the schema and resolvers and TypeDI to handle dependency injection.

The Cerbos client is setup as a global service which is then used in the GraphQL server.

To enable batching of requests, the authorization calls are performed via a dataloader instance which is configured per-request in the GraphQL server context and automatically adds in the principal information from the request.

new DataLoader(
  async (resources: ResourceCheck[]) => {
    const results = await cerbosService.cerbos.checkResources({
      principal: {
        id: user.id,
        roles: [user.role.toString()],
        attributes: JSON.parse(JSON.stringify(user)),
      },
      resources,
    });
    return resources.map(
      (key) =>
        results.findResult({ kind: key.resource.kind, id: key.resource.id })
    );
  }
)

Inside the GraphQL resolvers, calls to Cerbos can be done via using the context:

const authorized = await context.loaders.authorize.load({
  actions: ["view:approver"],
  resource: {
    id: expense.id,
    kind: "expense:object",
    attributes: {
      id: expense.id,
      region: expense.region,
      status: expense.status,
      ownerId: expense.createdBy.id,
    },
  },
});

Setup

• Have Node v18+ on your machine (recommend using NVM)
• Ensure your Docker is setup to pull ghcr.io/cerbos/cerbos:latest
• Run npm install to get the node dependencies.

Running

Cerbos is running separately in a docker container to the application and served on http://localhost:3593. To start this run cd cerbos && ./start.sh

To boot the GraphQL server run npm run start

Once running, you can access GraphQL Playground http://localhost:8000/graphql

## Policies

• IT can do everything
• Users can create invoices
• Users can view their invoices
• Users can update their own un-approved invoices
• Users can delete their own un-approved invoices
• Managers view all invoices in their region
• Managers update un-approved invoices in their region
• Managers delete un-approved invoices in their region
• Finance can view all invoices
• Finance can approve all invoices

Sample Queries

To run these you need to set an HTTP header called token which identifies the user (and thus there permissions)

Some exampe tokens:

• key:sajit:it is an IT Admin
• key:joe:finance is an EMEA Finance person
• key:sally:sales is an EMEA Sales person
• key:zeena:sales is an North America sales person
• key:john:manager-emea is an EMEA Manager in sales
• key:brock:manager-na is an North America Manager in sales

Get an Expense

{
  expense(id: "expense2") {
    id
    amount
    status
    vendor {
      name
    }
    createdBy {
      name
    }
    approvedBy {
      name
    }
  }
}

Approve an Expense

mutation {
  approveExpense(id: "expense1")
}

Demo Video - Watch this demo with commentary

Cerbos GraphQL Demo - Watch Video

Playground

Launch the policy from this demo in our playground. Play with it to see how Cerbos behaves.