Field-level permissions in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What fields are visible to a user with 'read:basic' permission?

Given this GraphQL schema snippet with field-level permissions, which fields will be visible to a user having only the 'read:basic' permission?

type User {
  id: ID!
  name: String! @auth(roles: ["read:basic"])
  email: String! @auth(roles: ["read:private"])
  phone: String @auth(roles: ["read:private"])
}

A id, name

B id, email, phone

C id, name, email

D id, name, email, phone

💡 Hint

Check which fields require 'read:basic' permission and which require 'read:private'.

The 'id' field is always visible. The 'name' field requires 'read:basic' permission, so it is visible. The 'email' and 'phone' fields require 'read:private' permission, which the user does not have.

🧠 Conceptual

intermediate

Why use field-level permissions in GraphQL?

What is the main reason to implement field-level permissions in a GraphQL API?

A To automatically generate documentation for fields

B To speed up query execution by limiting fields

C To control which fields a user can see or modify based on their role

D To enforce database schema constraints

💡 Hint

Think about security and data privacy.

Field-level permissions restrict access to specific fields depending on user roles or permissions, enhancing security and privacy.

📝 Syntax

advanced

Identify the syntax error in this GraphQL field-level permission directive

Which option contains the correct syntax for applying a field-level permission directive in GraphQL?

type Product {
  id: ID!
  price: Float! @auth(roles: ["admin", "manager"])
}

A price: Float! @auth(roles: ["admin", "manager"])

B price: Float! @auth(roles = ["admin", "manager"])

C price: Float! @auth(roles: "admin", "manager")

D price: Float! @auth(roles => ["admin", "manager"])

💡 Hint

Look carefully at the syntax for directive arguments in GraphQL.

GraphQL directives use colon ':' to assign argument values, and arrays are enclosed in square brackets. Option A follows this syntax correctly.

❓ optimization

advanced

How to optimize field-level permission checks in GraphQL resolvers?

Which approach best optimizes field-level permission checks to avoid redundant authorization logic in GraphQL resolvers?

A Add permission checks inside every resolver function manually

B Implement a centralized middleware that checks permissions before resolver execution

C Skip permission checks for fields that are rarely queried

D Use client-side validation to enforce permissions

💡 Hint

Think about avoiding repeated code and improving maintainability.

Centralized middleware handles permission checks once per request or field, reducing duplication and improving performance.

🔧 Debug

expert

Why does this GraphQL query return unauthorized error on a permitted field?

Given this schema and query, why does the user get an unauthorized error on the 'email' field even though they have 'read:basic' permission?

type User {
  id: ID!
  name: String! @auth(roles: ["read:basic"])
  email: String! @auth(roles: ["read:private"])
}

Query:
{
  user {
    id
    name
    email
  }
}

A The 'email' field is misspelled in the query

B The 'name' field permission overrides 'email' field permission

C The 'auth' directive is not supported on fields

D The user lacks the 'read:private' permission required for the 'email' field

💡 Hint

Check the permissions required for each field carefully.

The 'email' field requires 'read:private' permission, which the user does not have, causing the unauthorized error.

Practice

1. What is the main purpose of field-level permissions in GraphQL?

easy

A. To cache query results

B. To control access to individual data fields

C. To define the schema structure

D. To speed up query execution

Solution

1. Step 1: Understand the concept of field-level permissions

   Field-level permissions restrict who can see or edit specific fields in data, protecting sensitive information.

2. Step 2: Identify the main purpose

   The main goal is to control access to individual data fields, not to speed up queries or define schema structure.

3. Final Answer:

   To control access to individual data fields -> Option B

4. Quick Check:

   Field-level permissions = control access [OK]

Hint: Focus on access control for each field, not overall schema [OK]

Common Mistakes:

• Confusing permissions with schema design
• Thinking it speeds up queries
• Assuming it caches data

2. Which of the following is the correct way to apply a field-level permission directive in a GraphQL schema?

easy

A. type User { email: String @auth(role: "admin") }

B. type User { email: String auth(role: "admin") }

C. type User { email: String @auth[role="admin"] }

D. type User { email: String #auth(role: "admin") }

Solution

1. Step 1: Recall GraphQL directive syntax

   Directives use the @directiveName(arguments) format placed after the field type.

2. Step 2: Match the correct syntax

   type User { email: String @auth(role: "admin") } uses @auth(role: "admin") correctly. Options A, B, and D have syntax errors or wrong symbols.

3. Final Answer:

   type User { email: String @auth(role: "admin") } -> Option A

4. Quick Check:

   Directive syntax = @name(args) [OK]

Hint: Remember directives start with @ and use parentheses [OK]

Common Mistakes:

• Omitting the @ symbol
• Using brackets [] instead of parentheses ()
• Commenting out the directive

3. Given this GraphQL query and schema with field-level permissions:

type User { id: ID! name: String email: String @auth(role: "admin") }

If a user with role "user" runs:

{ user { id name email } }

What will be the result?

medium

A. { "data": { "user": { "id": "1", "name": "Alice", "email": "[e-mail]" } } }

B. { "data": { "user": { "id": "1", "name": "Alice", "email": null } } }

C. Error: Unauthorized to access field 'email'

D. { "data": { "user": { "id": "1", "name": "Alice" } } }

Solution

1. Step 1: Understand the permission on the email field

   The @auth(role: "admin") directive restricts email access to admin role only.

2. Step 2: Predict query result for a user role

   The user role is not admin, so email field is omitted from the response, not returned as null or error.

3. Final Answer:

   { "data": { "user": { "id": "1", "name": "Alice" } } } -> Option D

4. Quick Check:

   Unauthorized fields are omitted, not null or error [OK]

Hint: Unauthorized fields are hidden, not null or error [OK]

Common Mistakes:

• Expecting null instead of omitted field
• Expecting an error response
• Assuming all fields return regardless of role

4. You wrote this schema snippet:

type User { id: ID! name: String email: String @auth(role: admin) }

Why does this cause an error when applying field-level permissions?

medium

A. The role value admin should be a string in quotes

B. The @auth directive is not allowed on fields

C. ID! type cannot have directives

D. The email field must be nullable to use permissions

Solution

1. Step 1: Check the directive argument syntax

   Directive arguments must be valid GraphQL values; strings require quotes.

2. Step 2: Identify the error in role argument

   The role value admin is unquoted, causing a syntax error. It should be "admin".

3. Final Answer:

   The role value admin should be a string in quotes -> Option A

4. Quick Check:

   Directive args strings need quotes [OK]

Hint: Always put string arguments in quotes inside directives [OK]

Common Mistakes:

• Forgetting quotes around string arguments
• Thinking directives can't be on fields
• Assuming non-null types disallow directives

5. You want to allow users to see their own email field but only admins to see others' emails. Which field-level permission setup achieves this?

hard

A. Use @auth(role: "admin") on email field only

B. Make email field public and filter in resolver

C. Use a custom directive checking if user is owner or admin

D. Remove email field from schema and add a separate query

Solution

1. Step 1: Analyze the requirement

   Users can see their own email; admins can see all emails. This needs conditional logic.

2. Step 2: Evaluate options for conditional access

   Use a custom directive checking if user is owner or admin uses a custom directive to check ownership or admin role, fitting the requirement precisely.

3. Step 3: Why other options fail

   Use @auth(role: "admin") on email field only restricts email only to admins, blocking users from their own email. Make email field public and filter in resolver exposes email publicly, unsafe. Remove email field from schema and add a separate query complicates schema unnecessarily.

4. Final Answer:

   Use a custom directive checking if user is owner or admin -> Option C

5. Quick Check:

   Conditional access needs custom logic [OK]

Hint: Use custom directives for complex permission logic [OK]

Common Mistakes:

• Using simple role checks only
• Exposing sensitive fields publicly
• Overcomplicating schema with extra queries