Role-based access control in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

Query Result: Fetching User Roles

Given the following GraphQL query to fetch user roles, what will be the output?

query { user(id: "123") { id name roles } }

Assume the user with id "123" has roles: ["admin", "editor"]

GraphQL

query { user(id: "123") { id name roles } }

A {"data":{"user":{"id":"123","name":"Alice","roles":["admin","editor"]}}}

B {"data":{"user":{"id":"123","name":"Alice","roles":["user"]}}}

C {"errors":[{"message":"User not found"}]}

D {"data":{"user":null}}

💡 Hint

Check the roles assigned to the user with id "123".

The user with id "123" has roles "admin" and "editor". The query returns these roles correctly.

🧠 Conceptual

intermediate

Understanding Role Hierarchies

In a role-based access control system, which statement best describes role hierarchies?

A Roles can inherit permissions from other roles, allowing hierarchical access control.

B Roles are independent and cannot inherit permissions from other roles.

C Users can only have one role at a time, so hierarchies are unnecessary.

D Role hierarchies mean roles are assigned randomly without structure.

💡 Hint

Think about how permissions can be shared or extended between roles.

Role hierarchies allow roles to inherit permissions from other roles, simplifying management.

📝 Syntax

advanced

GraphQL Schema for Role-based Access Control

Which of the following GraphQL schema snippets correctly defines a User type with roles as a list of strings?

GraphQL

type User { id: ID! name: String! roles: [String!]! }

A type User { id: ID name: String roles: String }

B type User { id: ID! name: String! roles: [String!]! }

C type User { id: ID! name: String! roles: String! }

D type User { id: ID! name: String! roles: [String] }

💡 Hint

Roles should be a non-null list of non-null strings.

Option B correctly defines roles as a non-null list of non-null strings, ensuring roles are always present and valid.

❓ optimization

advanced

Optimizing Role Checks in GraphQL Resolvers

You want to optimize role checks in your GraphQL resolvers to avoid repeated database calls. Which approach is best?

A Fetch roles only when an error occurs.

B Fetch user roles separately in each resolver to ensure fresh data.

C Ignore roles and allow all access to simplify code.

D Fetch user roles once per request and cache them in context for all resolvers.

💡 Hint

Think about efficiency and avoiding repeated work.

Caching user roles once per request reduces database calls and improves performance.

🔧 Debug

expert

Debugging Role-based Access Control Error

Given this resolver snippet, what error will occur if the user object is null?

const resolver = (parent, args, context) => { if (!context.user.roles.includes('admin')) { throw new Error('Access denied'); } return 'Success'; }

A No error, returns 'Success'

B ReferenceError: roles is not defined

C TypeError: Cannot read property 'includes' of null

D Error: Access denied

💡 Hint

Consider what happens if context.user is null.

If context.user is null, accessing roles causes a TypeError because you cannot read properties of null.