GraphQL Authorization - How do I know if it is working?

Question

I have a locally-hosted instance of Magento and am testing out the GraphQL capabilities using postman.

I understand that I need to pass the access token via the Authorization header as a bearer token.

However, when I create a query in postman, the api always returns data whether I pass the authorization header or not. For instance,

query Categories {
    categories(filters: { parent_id: { eq: "2" } }) {
        items {
            id
            name
            path
        }
    }
}

Is it because the category entity type does not need authorization? If that is the case then is there a list of which types do require authorization?

Additionally, I have been unable to return an example product when I would expect to be able to, for instance:

query Products {
    products(filter: { sku: { eq: "24-MB01" } }) {
        total_count
    }
}

Is it likely that that is because that query does require authorization which is not working for whatever reason?

tl;dr - how do test whether authorization is working and being passed correctly?

Edit: I should note that I am not so interested in querying GraphQL from a customer's perspective, but rather via an integration where the access token is already generated in the magento back-end.

Edit2: I've just run a mutation to create a customer without passing any authorization, and it allowed it ok. That seems really strange to me, isn't that something you would expect to be covered by a form of security? Or is it that magento is leaving security up to IT in the form of firewalls etc

thanks :)

Answer 1

Get Customer tokens

Request:

mutation {
  generateCustomerToken(email: "[email protected]", password: "password") {
    token
  }
}

Response:

 {
   "data": {
     "generateCustomerToken": {
       "token": "hoyz7k697ubv5hcpq92yrtx39i7x10um"
     }
   }
 }

Add token in Header

Header name: Authorization
Header value: Bearer hoyz7k697ubv5hcpq92yrtx39i7x10um

Answer 2

GraphQL Authorization

GraphQL is one of the areas in Magento where we can send requests and get the responses that we want. Like website product data category data are general data that is available to all users. but when you need to update customer data, you just need to log in via email and password. The same thing in GraphQL after the customer Token you can able to get and update customer data. Without a customer token, you can not get and update customer data.

Once you created a token, you run a customer query: https://developer.adobe.com/commerce/webapi/graphql/schema/customer/queries/customer/

{
  customer {
    firstname
    lastname
    suffix
    email
    addresses {
      firstname
      lastname
      street
      city
      region {
        region_code
        region
      }
      postcode
      country_code
      telephone
    }
  }
}

GraphQL Authorization link: https://developer.adobe.com/commerce/webapi/graphql/usage/authorization-tokens/

[UPDATE]

By default, an admin token is valid for 4 hours. You can change these values from Admin by selecting Stores > Settings > Configuration > Services > OAuth > Access Token Expiration > Admin Token Lifetime.

Please check the document link where they provide a details description for it.

Answer 3

Under resolver class just write below code under resolve function

    public function resolve(Field $field, $context, ResolveInfo $info, array $value = null, array $args = null)
    {
        if (false === $context->getExtensionAttributes()->getIsCustomer()) {
            throw new GraphQlAuthorizationException(__('The current customer isn\'t authorized try again with correct authorisation token'));
        }
       //write your business code here
     }

I think this will resolve your issue