Repository navigation
useGenericAuth always calls validateUser even when @skipAuth #1470
Description
When using generic auth in "protect-all" mode the documentation states:
Then, in your GraphQL schema SDL, you can add @skipAuth directive to your fields, and the validateUser will not get called while resolving that specific field
This does not seem to be true. The validateUser always gets called, even when @skipAuth is set on the field.
I am not sure if documentation is wrong or there needs to be a check added to the plugins handleField function when @skipAuth is enabled.
Activity
n1ru4l commentedon Aug 12, 2022
Hey @aslansky do you think you can provide a minimal reproduction on CodeSandbox or Stackblitz or even better a PR with a failing test?
test: failing test for graphql-hive#1470 (always calling validateUser)
aslansky commentedon Aug 12, 2022
The behaviour is the same for @auth and @skipAuth, but as I said, I am not sure if this is expected behaviour and the user needs to handle the check for fieldAuthDirectiveNode and fieldAuthExtension in the custom validateUser function.
n1ru4l commentedon Aug 12, 2022
@aslansky From the test it is now more clear to me.
validateUseris called in that case as well because the field could behave differently based on whether a user is authenticated or not. E.g. if you have aQuery.feedfield it could either resolve to a generic feed if the user resolved fromvalidateUserisnullor a customized user feed if the user resolved fromvalidateUseris non-null9e.g. a user object).Does that make sense to you? In the meanwhile I will change this issue to a discussion!