Field-level permissions in GraphQL - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a GraphQL field with restricted access using a directive.

GraphQL

type User { id: ID!, name: String!, email: String! @[1] }

Drag options to blanks, or click blank then click option'

Apublic

Bprivate

Cauth

Dreadonly

Attempts:

3 left

💡 Hint

Common Mistakes

Using @private or @public which are not standard GraphQL directives for permissions.

Omitting the directive entirely.

The @auth directive is commonly used to enforce field-level permissions in GraphQL schemas.

2fill in blank

medium

Complete the code to specify a role-based access control directive on a GraphQL field.

GraphQL

type Post { content: String! @auth(role: "[1]") }

Drag options to blanks, or click blank then click option'

Aadmin

Bguest

Canonymous

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing roles like 'guest' or 'anonymous' which usually have less access.

Using roles not defined in the system.

The admin role is often used to restrict access to sensitive fields to administrators only.

3fill in blank

hard

Fix the error in the directive syntax to correctly restrict access to the 'salary' field.

GraphQL

type Employee { salary: Float! @auth(role: [1]) }

Drag options to blanks, or click blank then click option'

A'manager'

Bmanager

CMANAGER

D"manager"

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting quotes around the role name.

Using single quotes instead of double quotes.

The role value must be a string literal enclosed in double quotes inside the directive.

4fill in blank

hard

Fill both blanks to define a GraphQL query with field-level permission and a resolver function.

GraphQL

type Query { user: User @auth(role: "[1]") }

const resolvers = { Query: { user: () => [2] } }

Drag options to blanks, or click blank then click option'

Aadmin

BgetUser()

Cnull

Dguest

Attempts:

3 left

💡 Hint

Common Mistakes

Using a guest role for restricted data.

Returning null instead of user data in the resolver.

The query is restricted to the admin role, and the resolver calls getUser() to fetch user data.

5fill in blank

hard

Fill all three blanks to create a GraphQL schema with field-level permissions and a resolver that checks user role.

GraphQL

type User {
  id: ID!,
  email: String! @auth(role: "[1]")
}

const resolvers = {
  User: {
    email: (parent, args, context) => {
      if (context.user.role === "[2]") {
        return parent.[3];
      }
      return null;
    }
  }
};

Drag options to blanks, or click blank then click option'

Aadmin

Buser

Cemail

Dguest

Attempts:

3 left

💡 Hint

Common Mistakes

Mismatching roles between directive and resolver.

Returning the wrong field from the parent object.

The email field is restricted to the admin role. The resolver checks if the user's role is 'admin' and returns the email; otherwise, it returns null.