GraphQL: Replace homecooked Authorize logic with gem auth [RUN AS-IF-FOSS]
What does this MR do?
This MR replaces our homecooked auth with the gem provided framework.
We retain our handy declarative logic authorize :ability
for type-authorisations so the developer API remains constant.
According to the graphql-ruby auth docs, there are 3 layers that can declare authorisation:
- types (including Enumerations)
- fields (and the resolvers and mutations that implement them)
- arguments (We do not currently support this!)
I made the following changes:
- Removed the
Authorize
instrumentation and its declarativeuse
calls from the schema and GraphQL helper - Replaced
authorized_resource?
with gem methodauthorized?
- Removed
AuthorizeFieldService
Related Issues
Does this MR meet the acceptance criteria?
Conformity
- [-] Changelog entry As a developer facing change, no changelog is needed.
-
Documentation (if required) See: !55324 (merged) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process.
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec
-
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team
Related to #13984 (closed)
Edited by Alex Kalderimis