Field-level permissions in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What fields are visible to a user with 'read:basic' permission?

Given this GraphQL schema snippet with field-level permissions, which fields will be visible to a user having only the 'read:basic' permission?

type User {
  id: ID!
  name: String! @auth(roles: ["read:basic"])
  email: String! @auth(roles: ["read:private"])
  phone: String @auth(roles: ["read:private"])
}

A id, name

B id, email, phone

C id, name, email

D id, name, email, phone

💡 Hint

Check which fields require 'read:basic' permission and which require 'read:private'.

The 'id' field is always visible. The 'name' field requires 'read:basic' permission, so it is visible. The 'email' and 'phone' fields require 'read:private' permission, which the user does not have.

🧠 Conceptual

intermediate

Why use field-level permissions in GraphQL?

What is the main reason to implement field-level permissions in a GraphQL API?

A To automatically generate documentation for fields

B To speed up query execution by limiting fields

C To control which fields a user can see or modify based on their role

D To enforce database schema constraints

💡 Hint

Think about security and data privacy.

Field-level permissions restrict access to specific fields depending on user roles or permissions, enhancing security and privacy.

📝 Syntax

advanced

Identify the syntax error in this GraphQL field-level permission directive

Which option contains the correct syntax for applying a field-level permission directive in GraphQL?

type Product {
  id: ID!
  price: Float! @auth(roles: ["admin", "manager"])
}

A price: Float! @auth(roles: ["admin", "manager"])

B price: Float! @auth(roles = ["admin", "manager"])

C price: Float! @auth(roles: "admin", "manager")

D price: Float! @auth(roles => ["admin", "manager"])

💡 Hint

Look carefully at the syntax for directive arguments in GraphQL.

GraphQL directives use colon ':' to assign argument values, and arrays are enclosed in square brackets. Option A follows this syntax correctly.

❓ optimization

advanced

How to optimize field-level permission checks in GraphQL resolvers?

Which approach best optimizes field-level permission checks to avoid redundant authorization logic in GraphQL resolvers?

A Add permission checks inside every resolver function manually

B Implement a centralized middleware that checks permissions before resolver execution

C Skip permission checks for fields that are rarely queried

D Use client-side validation to enforce permissions

💡 Hint

Think about avoiding repeated code and improving maintainability.

Centralized middleware handles permission checks once per request or field, reducing duplication and improving performance.

🔧 Debug

expert

Why does this GraphQL query return unauthorized error on a permitted field?

Given this schema and query, why does the user get an unauthorized error on the 'email' field even though they have 'read:basic' permission?

type User {
  id: ID!
  name: String! @auth(roles: ["read:basic"])
  email: String! @auth(roles: ["read:private"])
}

Query:
{
  user {
    id
    name
    email
  }
}

A The 'email' field is misspelled in the query

B The 'name' field permission overrides 'email' field permission

C The 'auth' directive is not supported on fields

D The user lacks the 'read:private' permission required for the 'email' field

💡 Hint

Check the permissions required for each field carefully.

The 'email' field requires 'read:private' permission, which the user does not have, causing the unauthorized error.