Node.jsで安全なGraphQL APIを構築する

1// bootstrap npm project
2npm init -y
3
4// install dependencies
5npm i fastify nodemon fastify-plugin mercurius-auth jsonwebtoken

1npm i mercurius@7.9.1

1"scripts": {
2    // start the Node.js server in production
3    "start": "node --es-module-specifier-resolution=node ./src/index.js",
4    // use nodemon to restart development server when code is compiled
5    "dev": "nodemon --es-module-specifier-resolution=node ./src/index.js"
6}

1const schema =`
2  type Query {
3    users: [User]!
4  }
5
6  type User {
7    id: ID!
8  }
9  `;
10  export default schema;

1const resolvers = {};
2export default resolvers;

1import fastify from 'fastify';
2import mercurius from 'mercurius';
3import jwt from 'jsonwebtoken';
4import mercuriusAuth from 'mercurius-auth';
5import schema from './graphql/schema.js'; 
6import resolvers from './graphql/resolvers.js';
7
8const port = process.env.PORT || 4500;
9const app = fastify({ logger: true });
10
11// Activate plugins below:
12app.register(
13  mercurius, { 
14      schema, 
15      resolvers, 
16      graphiql: 'playground', 
17      queryDepth: 7 
18});
19
20// register auth policy
21
22// create server
23const start = async () => {
24  try {
25    await app.listen(port);
26  } catch (err) {
27    app.log.error(err);
28    process.exit(1);
29  }
30};
31start();

1{"level":30,"time":1620202591072,"pid":11775,"hostname":"pc-name","msg":"Server listening at http://127.0.0.1:4500"}

1export default {
2    users: [
3        { id: 1, username: 'JohnDoe', email: 'John_doe@gmail.com', password: '12345', role: 'admin' },
4        { id: 2, username: 'JaneDoe', email: 'Jane_doe@gmail.com', password: '12345', role: 'user' },
5        { id: 3, username: 'JoeDoe', email: 'Joe_doe@gmail.com', password: '12345', role: 'user' }
6    ]
7};

1const schema = `
2
3directive @auth(
4    requires: Role = ADMIN,
5  ) on OBJECT | FIELD_DEFINITION
6
7  enum Role {
8    ADMIN
9    USER
10  }
11
12type Query {
13    user(id: ID!): User! @auth(requires: ADMIN)
14    users: [User]! @auth(requires: ADMIN)
15    login(username:String!, password:String!): String
16}
17
18type User {
19    id: ID!
20    username: String!
21    email: String!
22    password: String!
23    role: String!
24}
25`;
26
27export default schema;

1import jwt from 'jsonwebtoken';
2import Data from '../data';
3
4const resolvers = {
5    Query: {
6        users: async (_, obj) => Data.users,
7
8        user: async (_, { id }) => {
9            let user = Data.users.find((user) => user.id == id);
10            if (!user) {
11                throw new Error('unknown user');
12            }
13            return user;
14        },
15
16        login: async (_, { username, password }) => {
17            let user = Data.users.find((user) => user.username === username && user.password === password);
18            if (!user) {
19                throw new Error('unknown user!');
20            }
21
22            const token = jwt.sign({ username: user.username, password: user.password, role: user.role }, 'mysecrete');
23            return token;
24        }
25    }
26};
27
28export default resolvers;

1app.register(mercuriusAuth, {
2    authContext(context) {
3        return { identity: context.reply.request.headers['x-user'] };
4    },
5    async applyPolicy(authDirectiveAST, parent, args, context, info) {
6        const token = context.auth.identity;
7        try {
8            const claim = jwt.verify(token, 'mysecrete');
9        } catch (error) {
10            throw new Error(`An error occurred. Try again!`);
11        }
12
13        return true;
14    },
15    authDirective: 'auth'
16});

1query {
2  login(username: "JohnDoe", password: "12345")
3}

1query {
2  users {
3    id
4    username
5    password
6    email
7    role
8  }
9}

1{
2  "x-user": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IkpvaG5Eb2UiLCJwYXNzd29yZCI6IjEyMzQ1Iiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNjQ0NTA3MDE5fQ.faslGjI6x-ODO2LGYOaTHClGs2MXCBOoMlWPYnwoH18"
3}

1query {
2  user(id: "1") {
3    id
4    username
5    email
6    password
7    role
8  }
9}

1{
2  "x-user": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IkpvaG5Eb2UiLCJwYXNzd29yZCI6IjEyMzQ1Iiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNjQ0NTA3MDE5fQ.faslGjI6x-ODO2LGYOaTHClGs2MXCBOoMlWPYnwoH18"
3}