A Ruby gem providing field-level authorization for GraphQL APIs with flexible policy definitions.
GraphQL Guard is a Ruby gem that adds field-level authorization to GraphQL APIs built with the graphql-ruby library. It solves the problem of securing GraphQL endpoints by allowing developers to define granular access controls on individual fields, ensuring users can only access data they're permitted to see. The gem provides flexible policy definitions through inline guards or centralized policy objects.
Ruby developers building GraphQL APIs with graphql-ruby who need to implement fine-grained authorization beyond basic authentication. Teams requiring integration with existing authorization systems like Pundit or CanCanCan.
Developers choose GraphQL Guard for its simplicity and seamless integration with graphql-ruby. Unlike monolithic authorization solutions, it focuses specifically on GraphQL field security with minimal configuration, supports existing authorization patterns, and offers flexible error handling without disrupting the GraphQL execution flow.
Simple authorization gem for GraphQL :lock:
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Allows precise authorization checks on individual GraphQL fields via inline guards or policy objects, enabling fine-grained access as shown in the usage examples.
Directly integrates with existing authorization systems like CanCanCan and Pundit without monkey patches, reusing current policies as demonstrated in the integration section.
Supports custom responses for unauthorized access, from raising errors to returning nil or GraphQL errors, configurable via not_authorized lambdas.
Can conditionally hide fields from introspection and access based on runtime context using mask blocks, useful for feature flags or beta testing.
The precedence order for guards (inline field, policy object field, inline type, policy object type) is nuanced and can lead to subtle bugs if misunderstood, as outlined in the priority section.
Requires adding guards to each field or type, which can become verbose and hard to manage in large GraphQL schemas with hundreds of fields.
Only compatible with graphql-ruby, making it unsuitable for other GraphQL implementations and vulnerable to breaking changes in the base library.