Role-based access control in GraphQL - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a role-based access control directive in GraphQL schema.

GraphQL

directive @auth(role: String!) on [1]

Drag options to blanks, or click blank then click option'

AQUERY

BSCHEMA

CMUTATION

DFIELD_DEFINITION

Attempts:

3 left

💡 Hint

Common Mistakes

Using QUERY or MUTATION which are operation types, not directive locations.

Using SCHEMA which applies directive to the whole schema, not specific fields.

The @auth directive is applied on field definitions to enforce role checks on specific fields.

2fill in blank

medium

Complete the resolver function to check if user role matches the required role.

GraphQL

if (user.role !== [1]) {
  throw new Error('Access denied');
}

Drag options to blanks, or click blank then click option'

Ainfo.role

Bargs.role

Ccontext.requiredRole

Dparent.role

Attempts:

3 left

💡 Hint

Common Mistakes

Using args.role which is input arguments, not the required role.

Using info.role or parent.role which are unrelated to access control here.

The required role is typically passed in the context for access control checks.

3fill in blank

hard

Fix the error in the directive resolver to correctly get the role argument.

GraphQL

const role = directiveNode.arguments.find(arg => arg.name.value === [1]).value.value;

Drag options to blanks, or click blank then click option'

A'role'

Brole

C"role"

Drole.value

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted role which causes a reference error.

Using role.value which is incorrect for the argument name.

The argument name is a string literal, so it must be enclosed in quotes.

4fill in blank

hard

Fill both blanks to define a GraphQL schema with a protected query field using the auth directive.

GraphQL

""
type Query {
  secretData: String [1] @auth(role: [2])
}
"""

Drag options to blanks, or click blank then click option'

A!

BString

C"ADMIN"

DInt

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting the exclamation mark which makes the field nullable.

Not quoting the role name which causes syntax errors.

The field is non-nullable (hence !) and the auth directive requires the role "ADMIN".

5fill in blank

hard

Fill all three blanks to implement a resolver that checks user role and returns data if authorized.

GraphQL

const resolver = (parent, args, context, info) => {
  if (context.user.role !== [1]) {
    throw new Error([2]);
  }
  return [3];
};

Drag options to blanks, or click blank then click option'

A"ADMIN"

B"Access denied"

Cparent.secretData

D"User"

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect role strings or error messages.

Returning wrong data or not throwing error on unauthorized access.

The resolver checks if the user role is "ADMIN", throws an error message "Access denied" if not, and returns the secret data from parent.secretData.