v0.26.0

[doug-martin]

Additional Authorization Context

In v0.26.0 @mwoelk added a new feature #1043 that passes additional context to authorizers.

The new AuthorizationContext type contains the following information

interface AuthorizationContext {
  /** The name of the method that uses the @AuthorizeFilter decorator */
  operationName: string;

  /** The group this operation belongs to */
  operationGroup: 'read' | 'aggregate' | 'create' | 'update' | 'delete';

  /** If the operation does not modify any entities */
  readonly: boolean;

  /** If the operation can affect multiple entities */
  many: boolean;
}

Below is a simple example of using the authorizationContext to allow all read requests to pass through, while any mutation will get an additional filter to ensure only records owned by the user are modified.

import { Injectable } from '@nestjs/common';
import { Authorizer } from '@nestjs-query/query-graphql';
import { Filter } from '@nestjs-query/core';
import { UserContext } from '../auth/auth.interfaces';
import { SubTaskDTO } from './dto/sub-task.dto';

@Injectable()
export class SubTaskAuthorizer implements Authorizer<SubTaskDTO> {
  authorize(context: UserContext, authorizationContext?: AuthorizationContext): Promise<Filter<SubTaskDTO>> {
    if (authorizationContext?.readonly) {
      return Promise.resolve({}); 
    }

    return Promise.resolve({ ownerId: { eq: context.req.user.id } });
  }

  authorizeRelation(relationName: string, context: UserContext): Promise<Filter<unknown>> {
    if (relationName === 'todoItem') {
      return Promise.resolve({ ownerId: { eq: context.req.user.id } });
    }
    return Promise.resolve({});
  }
}

Check out the docs to read more about the new feature!

Filter Only Fields

@mwoelk also added a new option to @FilterableField that allows exposing fields that can be used to filter results, but are not included in the result.

To use the new feature all you need to do is set the filterOnly option to true

// exclude assigneeId from results a but allow end users to filter on it. 
@FilterableField({ filterOnly: true })
assigneeId!: string;

You can check out the docs here

Set ManyToMany and OneToMany Relations

In previous versions of nestjs-query there was no way to easily set a manyToMany or oneToMany relation without calling both add and remove endpoints.

In the latest version a new endpoint has been added to quickly set the relations.

Assuming the following TodoItemDTO

import { FilterableField, CursorConnection } from '@nestjs-query/query-graphql';
import { ObjectType, ID, GraphQLISODateTime } from '@nestjs/graphql';
import { SubTaskDTO } from '../../sub-task/dto/sub-task.dto';
import { TagDTO } from '../../tag/dto/tag.dto';

@ObjectType('TodoItem')
@CursorConnection('tags', () => TagDTO)
export class TodoItemDTO {
  @FilterableField(() => ID)
  id!: number;

  @FilterableField()
  title!: string;

  @FilterableField({ nullable: true })
  description?: string;

  @FilterableField()
  completed!: boolean;

  @FilterableField(() => GraphQLISODateTime, { filterOnly: true })
  created!: Date;

  @FilterableField(() => GraphQLISODateTime, { filterOnly: true })
  updated!: Date;
}

A new end point call setTagsOnTodoItems is added that will remove and add relations in a single trip.

mutation {
   setTagsOnTodoItem(
     input: {
       id: 1,
       relationIds: [1, 2, 3, 4, 5]
    }
   ) {
      title
      tags {
        edges {
          node {
              name
          }
        }
      }
   }
}

If you set relationIds to an empty array all of the tags will be removed

mutation {
   setTagsOnTodoItem(input: { id: 1, relationIds: [] }) {
      title
      tags {
        edges {
          node {
              name
          }
        }
      }
   }
}