Welcome back to my series how to develop GraphQL API for rails applications from scratch.
Authentication - signIn method
To authenticate our users, we need to add jwt gem to our Gemfile
$ bundle add jwt
and create app/models/auth_token.rb
class AuthToken
def self.key
Rails.application.credentials.jwt_secret
end
def self.token(user)
payload = {user_id: user.id}
JWT.encode(payload, key)
end
def self.verify(token)
result = JWT.decode(token, key)[0]
User.find_by(id: result["user_id"])
rescue JWT::VerificationError, JWT::DecodeError
nil
end
end
How does it work. We use jwt_secret
which is stored in rails credentials to create a token which stores user_id
and to find User
record by token.
Let's create our jwt_secret
for development and test environments
$ rails credentials:edit --environment=development
$ rails credentials:edit --environment=test
and add the following line
jwt_secret: "secret"
Btw, don't forget to generate secure keys using
$ rails secret
Let's test it out.
AuthToken.key # "secret"
user = User.create(email: FFaker::Internet.email, password: SecureRandom.hex, first_name: FFaker::Name.first_name, last_name: FFaker::Name.last_name )
AuthToken.token(user) # "token-secret-value"
AuthToken.verify("token-secret-value") # returns User instance
Next, let's implement current_user
method. We need to update app/controllers/graphql_controller.rb
class GraphQLController < ApplicationController
protect_from_forgery with: :null_session # <-- uncomment this line
def execute
variables = prepare_variables(params[:variables])
query = params[:query]
operation_name = params[:operationName]
context = {
current_user: current_user # <-- add this line
}
result = GraphqlFromScratchSchema.execute(query, variables: variables, context: context, operation_name: operation_name)
render json: result
rescue => e
raise e unless Rails.env.development?
handle_error_in_development(e)
end
############### Add this method
def current_user
return nil if request.headers["Authorization"].blank?
token = request.headers["Authorization"].split(" ").last
return nil if token.blank?
AuthToken.verify(token)
end
###############
end
We need to create our mutation in app/graphql/mutations/users/sign_in.rb
module Mutations::Users
class SignIn < Mutations::BaseMutation
graphql_name "signIn"
argument :email, String, required: true
argument :password, String, required: true
field :user, Types::UserType, null: true
field :token, String, null: true
def resolve(email:, password:)
user = User.find_by(email:)
errors = {}
if user&.authenticate(password)
context[:current_user] = user
token = AuthToken.token(user)
{token: AuthToken.token(user), user:, success: true}
else
user = nil
context[:current_user] = nil
raise GraphQL::ExecutionError, "Incorrect Email/Password"
end
end
end
end
and add it to app/graphql/types/mutation_type.rb
module Types
class MutationType < Types::BaseObject
field :sign_up, mutation: Mutations::Users::SignUp
field :sign_in, mutation: Mutations::Users::SignIn # <-- add this line
end
end
Let's try it in our GraphQL console
mutation {
signIn(input: { email: "test@example.com", password: "1234567890" }) {
user {
id
email
name
}
success
token
}
}
And you'll see a result
{
"data": {
"signIn": {
"user": {
"id": "9a7fb463-2493-48f6-8641-509f58c9b47f",
"email": "test@example.com",
"name": "Alexey Poimtsev"
},
"success": true,
"token": "correct-token"
}
}
}
In case of wrong email/password
mutation {
signIn(input: { email: "test@example.com", password: "111" }) {
user {
id
email
name
}
success
token
}
}
You'll see an error message
{
"data": {
"signIn": null
},
"errors": [
{
"message": "Incorrect Email/Password",
"locations": [
{
"line": 2,
"column": 3
}
],
"path": ["signIn"]
}
]
}
Don't forget to write specs spec/graphql/mutations/users/sign_in_spec.rb
require "rails_helper"
RSpec.describe "#signIn mutation" do
before do
@password = SecureRandom.hex
@user = FactoryBot.create(:user, email: "user@example.com", password: @password)
end
let(:mutation) do
<<~GQL
mutation signIn($email: String!, $password: String!) {
signIn(input: {
email: $email
password: $password
}) {
user {
id
email
name
}
token
}
}
GQL
end
it "is successful with correct email and password" do
result = GraphqlFromScratchSchema.execute(mutation, variables: {
email: "user@example.com",
password: @password
})
expect(result.dig("data", "signIn", "errors")).to be_nil
expect(result.dig("data", "signIn", "user", "email")).to eq("user@example.com")
expect(result.dig("data", "signIn", "user", "id")).to be_present
expect(result.dig("data", "signIn", "token")).to be_present
end
it "fails with wrong password" do
result = GraphqlFromScratchSchema.execute(mutation, variables: {
email: "user@example.com",
password: "wrong-password"
})
expect(result.dig("data", "signIn", "user", "id")).to be_nil
expect(result.dig("data", "signIn", "token")).to be_nil
expect(result.dig("errors", 0, "message")).to eq("Incorrect Email/Password")
end
end
Let's break for a while to improve our code a bit.
Improvements - whoAmI method, inflections and GraphQL schema dump
Let's add a helper method to easily test our authentication. Add following lines to app/graphql/types/query_type.rb
(you can replace test_field
method)
field :who_am_i, String, null: false,
description: "Who am I"
def who_am_i
"You've authenticated as #{context[:current_user].presence || "guest"}."
end
If you're not authenticated
{
whoAmI
}
you'll see
{
"data": {
"whoAmI": "You've authenticated as guest."
}
}
But if you use correct token
{
"Authorization": "correct-token"
}
You'll see
{
"data": {
"whoAmI": "You've authenticated as Alexey Poimtsev."
}
}
Let's play with inflections. Open file config/initializers/inflections.rb
and make in looks like
ActiveSupport::Inflector.inflections(:en) do |inflect|
inflect.acronym "RESTful"
inflect.acronym "GraphQL" # <-- add this line
end
Now, we can rename in app/controllers/graphql_controller.rb
class name GraphqlController
to GraphQLController
. Looks better, isn't it? But don't forget to rename every Graphql
string in class names to GraphQL
.
Let's add rake task for schema dump. I've created lib/tasks/graphql.rake
with following code
namespace :graphql do
desc "Dump GraphQL schema"
task dump_schema: :environment do
# Get a string containing the definition in GraphQL IDL:
schema_defn = GraphQLFromScratchSchema.to_definition
# Choose a place to write the schema dump:
schema_path = "app/graphql/schema.graphql"
# Write the schema dump to that file:
File.write(Rails.root.join(schema_path), schema_defn)
puts "Updated #{schema_path}"
end
end
and added spec in spec/graphql/schema_spec.rb
require "rails_helper"
RSpec.describe "GraphQL schema" do
it "must be reflected in the .graphql file" do
current_defn = GraphQLFromScratchSchema.to_definition
printout_defn = File.read(Rails.root.join("app/graphql/schema.graphql"))
assert_equal(current_defn, printout_defn, "Update the printed schema with `bundle exec rake dump_schema`")
end
end
Now, with
$ rake graphql:dump_schema
I'll have updated schema in app/graphql/schema.graphql
and specs will remind me to update it.
Top comments (0)