Built-in authorization in graphql-ruby 1.8+

Hi!

GraphQL 1.8.0 introduced a new class-based API for building your schema. Did you know that since then, 1.8 has also gotten built-in authorization? Notable features include:

- Simplicity: It's implemented by defining methods on your GraphQL schema & type classes.
- Extensibility: It's plain ol' Ruby, so you can combine logic using your favorite Ruby techniques.
- Consistency: It's built into the runtime, so you can be sure that every object passes through authorization before being returned to a client.

You can read up about the new system on the website. It works with class-based GraphQL schemas only, so if you haven't upgraded yet, give it a try!

Besides that, the Pundit integration and CanCan integration have been rebuilt to leverage this new system, so they benefit from all the features described above.

So, update your gem version and kick the tires! We've been running the new authorization system at GitHub for a bit over a month now.

Happy hacking,

Robert