@treedom/mercurius-auth-opa

Mercurius Auth OPA is a plugin for Mercurius that adds an Authentication and Authorization directive using Open Policy Agent

Made with ❤️ at  , join us in making a difference!

Usage

import { opaAuthPlugin } from "@treedom/mercurius-auth-opa";
import { opaAuthDirective } from "@treedom/mercurius-auth-opa/opaAuthDirective";

const schema = `#graphql
  ${opaAuthDirective}

  type Query {
    ping(message: String!): String! @opa(path: "my/opa/policy", options: { ... })
  }`

app.register(mercurius, {
  schema,
  resolvers: {
    Query: {
      ping: (source, args) => args.message,
    },
  },
})

app.register(opaAuthPlugin, {
  opaEndpoint: 'https://my.opa.endpoint',
})

OPA policy input

This plugin queries OPA providing the following properties as input

• headers the Fastify headers object
• parent the Mercurius parent object of the field/object which got queried
• args the Mercurius args object of the field/object which got queried
• options static untyped properties defined in the directive arguments (optional)

Example Rego Policy

Let's imagine a GraphQL server which accept requests authorized using JWTs containing the role property in their claims. The following Rego uses a hypotetical oidc.verify_token that validates the JWT signature and returns the token claims or false if the token is not valid.

package my.opa.policy

import rego.v1
import data.oidc

default allow := false

allow if {
    user := oidc.verify_token(input.headers.authorization)

    user
    user.role = "admin"
}

Custom directive

The authorization directive can be customized registering a custom one in the schema and specifying its name in the plugin configuration

scalar OpaOptions
directive @policy(path: String!, options: OpaOptions) on OBJECT | FIELD_DEFINITION

app.register(opaAuthPlugin, {
  // ...
  authDirective: 'policy'
})

app.register(opaAuthPlugin, {
  // ...
  opaOptions: {
    // ...
  }
})

🌳 Join Us in Making a Difference! 🌳

We invite all developers who use Treedom's open-source code to support our mission of sustainability by planting a tree with us. By contributing to reforestation efforts, you help create a healthier planet and give back to the environment. Visit our Treedom Open Source Forest to plant your tree today and join our community of eco-conscious developers.

Additionally, you can integrate the Treedom GitHub badge into your repository to showcase the number of trees in your Treedom forest and encourage others to plant new ones. Check out our integration guide to get started.

Together, we can make a lasting impact! 🌍💚

Contributing

Contributions are welcome! Please read the contributing guidelines before submitting a pull request.

License

This project is licensed under the MIT License.