Graphql-shield: Not authorized error on every query

[devautor]

Question about GraphQL Shield

I am trying to get graphql shield working with my already in use apollo server v2, with applyMiddleware as other posts have suggested. The problem is that it is always giving me the same Not authorized error in the playground. I am attaching details below, though I understand that this has to do with me not understanding how graphql-shield behaves. Please correct what am I doing wrong here, or direct me to right posts/resources.

Apollo server initialized as:

const server = new ApolloServer({
  schema: applyMiddleware(makeExecutableSchema({
                    typeDefs: importSchema("./src/schema.graphql"),
                    resolvers: resolvers as any
               });, permissions);,
  context: ({ req, res }: any): Context => ({
    req,
    res,
    prisma: Prisma
  })
});

permissions.ts:

import { shield, allow } from "graphql-shield";
const permissions = shield({
  Query: {
    me: allow
  }
});
export default permissions;

Query:

query Quereis {
  me {
    id
    email
    name
  }
}

Error stack:

{
  "errors": [
    {
      "message": "Not Authorised!",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "me"
      ],
      "extensions": {
        "code": "INTERNAL_SERVER_ERROR",
        "exception": {
          "stacktrace": [
            "Error: Not Authorised!",
            "    at normalizeOptions (G:\\gql-shield\\gql-shield-apollo\\node_modules\\graphql-shield\\src\\shield.ts:25:32)",
            "    at Object.shield (G:\\gql-shield\\gql-shield-apollo\\node_modules\\graphql-shield\\src\\shield.ts:43:29)",
            "    at Object.<anonymous> (G:\\gql-shield\\gql-shield-apollo\\src\\auth\\permissions.ts:11:21)",
            "    at Module._compile (module.js:652:30)",
            "    at Module.m._compile (G:\\gql-shield\\gql-shield-apollo\\node_modules\\ts-node\\src\\index.ts:439:23)",
            "    at Module._extensions..js (module.js:663:10)",
            "    at Object.require.extensions.(anonymous function) [as .ts] (G:\\gql-shield\\gql-shield-apollo\\node_modules\\ts-node\\src\\index.ts:442:12)",
            "    at Module.load (module.js:565:32)",
            "    at tryModuleLoad (module.js:505:12)",
            "    at Function.Module._load (module.js:497:3)"
          ]
        }
      }
    }
  ],
  "data": {
    "me": null
  }
}

EDIT: Same error stack is seen if I query any other field, which I assume is possibly because permission is deny by default in graphql-schema.
EDIT2: I was wrong on this too, fallback rule is allow by default!

_I have checked other questions and found none that matches mine._

[maticzav]

Hmm, this is indeed very strange. Would you mind creating a simple reproduction repository? This way I can help you a lot more quickly.

Besides that, all I can think of from the issue report;

1. I made a terrible mistake somewhere in the code which I doubt because we have 100% coverage, however possible.
2. There’s an error in the execution of your resolvers. Try setting debug flag to true and see if you can find anything.

I hope this helps you with your problem 🙂

[devautor]

Sure @maticzav I am trying to carve out a small reproduction, but the code is so much into modules, I am spending some time to work this out :)

EDIT: This is my code reproduction here https://codesandbox.io/s/5wmr686r3x.

[maticzav]

@devautor this is perfect! Could you help me with something? I am trying to locate shield folder in Sandbox but cannot find it, can you see it?

[devautor]

Hey @maticzav Codesandbox is really playing today, it was showing two of those directories while I was coding; I can't see it too, while code gets it :)
BTW this is my permissions.ts (it's the only file in shield directory):

import { shield, allow } from "graphql-shield";
//import { Context } from "../context";

// const rules = {
//   isAuthenticatedUser: rule()(async (parent, args, ctx, info) => {
//     console.log(`Shield is activated... ${JSON.stringify(ctx, null, 2)}`);
//     return true;
//   })
// };

const permissions = shield({
  Query: {
    me: allow
  }
});

export default permissions;

[maticzav]

@devautor try this;

const permissions = shield(
  {
    Query: {
      me: allow
    }
  },
  {
    debug: true
  }
);

graphql-shield by default prevents any internal logic from being exposed. Because your resolvers are throwing errors, shield hides them but responds with Not Authorised! message, as if a user has no permission to access them.

By setting debug property to true, however, you can access the underlying errors.

Hope this fixes your problem 🙂

[devautor]

Thanks @maticzav That seems to be the issue, and rather a stupid one. On switching to the debug mode, I am now getting this error message: "message": "Resolver not implemented",.

[maticzav]

Perfect! Feel free to close the issue as soon as you think we fixed it. Also, don't hesitate to ask any further questions regarding functionality or even opening another issue 🙂

[devautor]

@maticzav I have read some issues here, and you have been equally polite to everyone of them. So much to learn from you, thank you for being so welcoming :)