Hi all, I'm new to graphql, and I was wondering wh...

# graphql-kotlin

[vio]

Hi all, I'm new to graphql, and I was wondering what is the best way to implement queries/mutations with restricted access based on user rights? in a restful api we would make endpoints restricted, I'm not sure how to approach this with graphql. I'm using ktor as well and graphql-kotlin. Thank you!

[Dariusz Kuc]

I’d assume you would be using some authentication directives (see https://github.com/ExpediaGroup/graphql-kotlin/issues/663 and https://github.com/ExpediaGroup/graphql-kotlin/issues/692)

[vio]

Thank you, I'll look into them 🙂

[Robert]

is there a best practice which could be added to to the docs? Or even code to graphql-kotlin-spring-server?

[Dariusz Kuc]

I’m thinking that the best place for those conversations would be under https://help.github.com/en/github/building-a-strong-community/about-team-discussions

[Dariusz Kuc]

unfortunately it is still in private beta 😞

[Dariusz Kuc]

in the meantime we can probably add some high level overview to the docs

[Dariusz Kuc]

as for the reference implementation - well it is a very broad topic and there is quite a few ways this could be implemented so I don’t think we will be adding it to the spring-server

[Dariusz Kuc]

data fetchers are plain java classes

[Dariusz Kuc]

they don’t know anything about suspendable functions nor monad types

[Dariusz Kuc]

any specific reason you need to store mono in the graphql context instead of unwrapping it?

[Robert]

Nope, I overlook that GraphQLSecurityContextFactory uses `suspend`for the generateContext, which makes it super easy to use later 👍

[Dariusz Kuc]

👍 yeah its suspendable so we can access reactor context through their nice interop