Field-Level Authorization
Authorization belongs in the business layer that resolvers call — not in the HTTP gateway, which sees one opaque POST — with the viewer identity carried in resolver context. Per-type/per-field policies (or auth directives) decide visibility; a denied field returns null or a typed error, respecting its nullability contract.
This Concept is waiting for its first lesson!
Authorization belongs in the business layer that resolvers call — not in the HTTP gateway, which sees one opaque POST — with the viewer identity carried in resolver context. Per-type/per-field policies (or auth directives) decide visibility; a denied field returns null or a typed error, respecting its nullability contract.
Are you a teacher? Sign in to start contributing.
Sign In