- Update
authorization
to use type-levelresolve_type
hooks
- Update authorization instrumentation for
graphql >= 1.6.5
- Fix typo in RelationConnection source
- Correctly fall back to offset-based cursors with
before:
argument
- Add
Schema#unauthorized_object(obj, ctx)
hook for failed runtime checks
- Prevent usage of
parent_role:
withview:
oraccess:
(since parent role requires a runtime check) - Fix versioned, encrypted cursors with 16-byte legacy cursors
OrderedRelationConnection
supports ordering by joined fields
- Update auth plugin for new Relay instrumenters
Pro::Encoder
supportsencoder(...)
as documented
- Fix compatibility of
RelationConnection
andRangeAdd
helper
- Add
:datadog
monitoring
ActiveRecord::Relation
s can be scoped by PunditScope
s, CanCanaccessible_by
, or custom strategy's#scope(gate, relation)
methods- Default authorization configuration can be provided with
authorization(..., fallback: { ... })
- Authorization's
:current_user
key can be customized withauthorization(..., current_user: ...)
- Serve static, persisted queries with
GraphQL::Pro::Repository
- Fix compatibility of
RelationConnection
andRangeAdd
helper
- Raise
GraphQL::Pro::RelationConnection::InvalidRelationError
when a grouped, unordered relation is returned from a field. (This relation can't be stably paginated.)
- Formally support ActiveRecord
>= 4.1.0
- Support grouped relations in
GraphQL::Pro::RelationConnection
-
Authorize fields based on their parent object, for example:
AccountType = GraphQL::ObjectType.define do name "Account" # This field is visible to all users: field :name, types.String # This is only visible when the current user is an `:owner` # of this account field :account_balance, types.Int, authorize: { parent_role: :owner } end
- Fix monitoring when
Query#selected_operation
is nil
- Add AppSignal monitoring platform
- Add type- and field-level opting in and opting out of monitoring
- Add
monitor_scalars: false
to skip monitoring on scalars
- Fix
OrderedRelationConnection
when neitherfirst
norlast
are provided (usemax_page_size
or don't limit)
OrderedRelationConnection
exposes more metadata methods:parent
,field
,arguments
,max_page_size
,first
,after
,last
,before
- When an authorization check fails on a non-null field, propagate the null and add a response to the errors key (as if the field had returned null). It previously leaked the internal symbol
__graphql_pro_access_not_allowed__
. - Apply a custom Pundit policy even when the value isn't
nil
. (It previously fell back toPundit.policy
, skipping apundit_policy_name
configuration.)
OrderedRelationConnection
exposes the underlying relation as#nodes
(likeRelationConnection
does), supporting custom connection fields.
-
CanCan integration now supports a custom
Ability
class with theability_class:
option:authorize :cancan, ability_class: CustomAbility
GraphQL::Pro
released