InputValidationPlugin running before AuthScopesPlugin

[ecesar88]

Hi! I am using both the InputValidationPlugin, the ErrorsPlugin and the AuthScopesPlugin and everything works mostly fine.
The only problem I have is that the InputValidationPlugin is run before the AuthScopesPlugin, no matter the order in which I pass them to the builder's plugins array. Which results in mutations' payloads being validated before checking if the user is authorized, which shouldn't happen.

I have tried modifying the order of the plugins specified in the builder options already and it does not seem to matter (which is weird).

I'm probably doing something wrong here. I have already read the docs countless times and finally decided to ask a question.

Is there any way I can force the execution of the AuthScopesPlugin before InputValidationPlugin runs?

This is my current builder options:

export const builder = new SchemaBuilder<SchemaType>({
	// plugins: [ValidationPlugin, ErrorsPlugin, ScopeAuthPlugin],
	plugins: [ErrorsPlugin, ScopeAuthPlugin, ValidationPlugin],
	errors: {
		unsafelyHandleInputErrors: true,
	},
	scopeAuth: {
		treatErrorsAsUnauthorized: true,
		// runScopesOnType: true,
		unauthorizedError: (_parent, _context, info, _result) => {
			const { operation } = info

			const operationType = operation.operation
			const resolverName = operation.name?.value

			logger({
				level: LOG_LEVEL.WARN,
				message: "Unauthorized",
			})

			return new AuthError(`Not authorized to resolve ${operationType}.${resolverName}`)
		},
		authorizeOnSubscribe: true,
		authScopes: async (context) => ({
			isAuthenticated: !!context.user
		}),
	},
	tracing: {
		// Enable tracing for rootFields by default, other fields need to opt in
		default: (config) => isRootField(config),
		// Log resolver execution duration
		wrap: (resolver, _options, config) =>
			wrapResolver(resolver, (error, duration) => {
				if (error) {
					logger({
						level: LOG_LEVEL.ERROR,
						message: (error as Error)?.message ?? "",
					})
				}

				logger({
					level: LOG_LEVEL.INFO,
					message: `Executed resolver ${config.parentType}.${config.name
						} in ${duration.toFixed(2)}ms`,
				})
			}),
	},
})

[hayes]

This is somewhat intentional, and there isn't currently a way around it, but something I am open to exploring.

The issue is that some auth checks rely on arguments and the only way to make this type-safe and work predictably is for validation to run first.

I'm curious what kinds of validation you are doing that you want auth to run first?

[ecesar88]

I'm using the InputValidationPlugin along with zod to validate the user payload for mutations and possibly queries that include pagination parameters - but mainly on mutations. An existing operation/resolver looks like this:

builder.mutationField("createUser", (t) =>
  t.authField({
    description: "Create a new user",
    authScopes: { isAuthenticated: true },
    type: User,
    args: {
      data: t
        .arg({
          type: UserCreateInput,
          required: true,
        })
        .validate(CreateUserValidationSchema),
    },
    resolve: create,
  })
);

And this is the zod schema for it:

export const CreateUserValidationSchema = z.object({
  name: z.string().min(3),
  username: z.string().min(3),
  email: z.email(),
  phone: z.string().regex(PHONE_REGEX, "Invalid phone number"),
  password: z.string().min(8).max(32),
});

I just think that it makes more sense to first check if a user can perform the action before even worrying about validating the data they're sending. However, I'm ok with that if it doesn't pose any major security or performance caveats.