{"id":1146,"date":"2020-10-20T20:46:09","date_gmt":"2020-10-20T20:46:09","guid":{"rendered":"http:\/\/10.0.0.14\/?p=1146"},"modified":"2021-09-07T23:31:43","modified_gmt":"2021-09-07T23:31:43","slug":"tdd-with-django-graphene-docker-part-5-jwt","status":"publish","type":"post","link":"https:\/\/tutorials.leesonresearch.com\/tutorials\/2020\/10\/20\/tdd-with-django-graphene-docker-part-5-jwt\/","title":{"rendered":"TDD with Gatsby, Django & Docker Part 1, Chapter 05 — Django JWT"},"content":{"rendered":"\n

Authentication with GraphQL & JWT<\/h1>\n\n\n\n

Django comes with Users built in so, first we build our user app.<\/p>\n\n\n\n

Create Our First User<\/h4>\n\n\n\n

Create a new folder called \/server\/users<\/strong> at the root of server with a new file schema.py: \/todo-app-graphql\/server\/users\/schema.py<\/strong> <\/p>\n\n\n

\nmkdir server\/users\ntouch server\/user\/schema.py\n<\/pre><\/div>\n\n\n
In our new \/server\/user\/schema.py file add the following:<\/p>\n\n\n
\n# \/todo-app-graphql\/server\/users\/schema.py\n\nfrom django.contrib.auth import get_user_model\n\nimport graphene\nfrom graphene_django import DjangoObjectType\n\nclass UserType(DjangoObjectType):\n  class Meta:\n    model = get_user_model()\n\nclass CreateUser(graphene.Mutation):\n  user = graphene.Field(UserType)\n\n  class Arguments:\n    username = graphene.String(required=True)\n    password = graphene.String(required=True)\n    email    = graphene.String(required=True)\n\n  def mutate(self, info, username, password, email):\n    user = get_user_model()(\n      username=username,\n      email=email,\n    )\n    user.set_password(password)\n    user.save()\n\n    return CreateUser(user=user)\n\nclass Mutation(graphene.ObjectType):\n  create_user = CreateUser.Field()\n<\/pre><\/div>\n\n\n
Like our previous mutation CreateTodo we a CreateUser passing in the username, password, and email for our new user.<\/p>\n\n\n\n
We are ready to update our todo-app-graphql\/server\/todo_proj\/schema.py<\/strong> file with our new user mutation:<\/p>\n\n\n
\n# todo-app-graphql\/server\/todo_proj\/schema.py\n\nimport graphene\n\nimport todo_app.schema\nimport users.schema\n\nclass Query(\n  todo_app.schema.Query,\n  graphene.ObjectType\n):\n  pass\n\nclass Mutation(users.schema.Mutation, todo_app.schema.Mutation, graphene.ObjectType):\n  pass\n\nschema = graphene.Schema(query=Query, mutation=Mutation)\n<\/pre><\/div>\n\n\n
Create a New User with GraphiQL<\/h4>\n\n\n\n
Add the following to GraphiQL at http:\/\/localhost:5555\/graphql:<\/p>\n\n\n
\nmutation {\n  createUser(\n    username: "ron",\n    email: "ron@example.com",\n    password: "123456A!"\n  ) {\n    user {\n    id,\n    username,\n    email\n    }\n  }\n}\n<\/pre><\/div>\n\n\n
… which should create our new user.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Query the Users<\/h4>\n\n\n\n
Next we update the server\/users\/schema.py<\/strong> file with a query, (see highlighted lines), to list all our users in the database.<\/p>\n\n\n
\n# todo-app-graphql\/server\/users\/schema.py\n\n\nfrom django.contrib.auth import get_user_model\nimport graphene\nfrom graphene_django import DjangoObjectType\n\nclass UserType(DjangoObjectType):\n  class Meta:\n    model = get_user_model()\n\nclass CreateUser(graphene.Mutation):\n  user = graphene.Field(UserType)\n\n  class Arguments:\n    username = graphene.String(required=True)\n    password = graphene.String(required=True)\n    email    = graphene.String(required=True)\n\n  def mutate(self, info, username, password, email):\n    user = get_user_model() (\n      username=username, \n      email = email,\n    )\n    user.set_password(password)\n    user.save()\n\n    return CreateUser(user=user)\n\nclass Mutation(graphene.ObjectType):\n  create_user = CreateUser.Field()\n\nclass Query(graphene.ObjectType):\n  users = graphene.List(UserType)\n\n  def resolve_users(self, info):\n    return get_user_model().objects.all()\n<\/pre><\/div>\n\n\n
Update the main query class with our new users query:<\/p>\n\n\n
\n# todo-app-graphql\/server\/todo_proj\/schema.py\n\n# ... code\nclass Query(\n  users.schema.Query,\n  todo_app.schema.Query,\n  graphene.ObjectType\n):\n  pass\n<\/pre><\/div>\n\n\n
We can now add the following query to GraphiQL to query all our users in the database:<\/p>\n\n\n
\nquery {\n  users{\n    id\n    username\n    email\n  }\n}\n<\/pre><\/div>\n\n\n
… and voila! Our list of users.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Authenticating Our Users<\/h4>\n\n\n\n
Most of the web apps today are stateless<\/em> so, we will use the django-graphql-jwt<\/a> library to implement JWT Tokens<\/a> in Graphene.<\/p>\n\n\n\n
When a User signs up or logs in, a token will be returned: a string of data that identifies the User. This token must be sent by the User in the HTTP Authorization header with every request<\/em> when authentication is needed. If you want to know more about Django JWT checkout the official docs<\/a>.<\/p>\n\n\n\n
Configuring django-graphql-jwt<\/h4>\n\n\n\n
If you cut and paste all the requirements into the requirements.txt file from part one of this tutorial, you already have django-graphql-jwt installed. If not you can install with the following<\/p>\n\n\n
\ndocker-compose run server pip install django-graphql-jwt\n<\/pre><\/div>\n\n\n
To configure add the following to the MIDDLEWARE variable the todo-app-graphql\/server\/todo_proj\/settings.py file:<\/p>\n\n\n
\n# todo-app-graphql\/server\/todo_proj\/settings.py\n\n# ... code\n\nMIDDLEWARE = [\n    'django.middleware.security.SecurityMiddleware',\n    'django.contrib.sessions.middleware.SessionMiddleware',\n    'django.middleware.common.CommonMiddleware',\n    'django.middleware.csrf.CsrfViewMiddleware',\n    'django.contrib.messages.middleware.MessageMiddleware',\n    'django.middleware.clickjacking.XFrameOptionsMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n]\n\nGRAPHENE = {\n  'SCHEMA': 'todo_proj.schema.schema',\n  'MIDDLEWARE': [\n    'graphql_jwt.middleware.JSONWebTokenMiddleware',\n   ],\n}\n<\/pre><\/div>\n\n\n
The entire server\/todo_proj\/settings.py should look like this now with highlighted lines of updates:<\/p>\n\n\n
\n# server\/todo_proj\/settings.py\n\n"""\nDjango settings for todo_proj project.\n\nGenerated by 'django-admin startproject' using Django 3.2.5.\n\nFor more information on this file, see\nhttps:\/\/docs.djangoproject.com\/en\/3.2\/topics\/settings\/\n\nFor the full list of settings and their values, see\nhttps:\/\/docs.djangoproject.com\/en\/3.2\/ref\/settings\/\n"""\n\nfrom pathlib import Path\n\n# Build paths inside the project like this: BASE_DIR \/ 'subdir'.\nBASE_DIR = Path(__file__).resolve().parent.parent\n\n\n# Quick-start development settings - unsuitable for production\n# See https:\/\/docs.djangoproject.com\/en\/3.2\/howto\/deployment\/checklist\/\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = 'django-insecure-z6a#15u#4bw092uhpnvhbc_h!p$!&amp;&amp;g&amp;qvb5dq3vj7kj3@#%bg'\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = True\n\nALLOWED_HOSTS = []\n\n\n# Application definition\n\nINSTALLED_APPS = [\n    'django.contrib.admin',\n    'django.contrib.auth',\n    'django.contrib.contenttypes',\n    'django.contrib.sessions',\n    'django.contrib.messages',\n    'django.contrib.staticfiles',\n    'todo_app',\n    'mptt',\n    'graphene_django',\n]\n\nMIDDLEWARE = [\n    'django.middleware.security.SecurityMiddleware',\n    'django.contrib.sessions.middleware.SessionMiddleware',\n    'django.middleware.common.CommonMiddleware',\n    'django.middleware.csrf.CsrfViewMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n    'django.contrib.messages.middleware.MessageMiddleware',\n    'django.middleware.clickjacking.XFrameOptionsMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n]\n\nROOT_URLCONF = 'todo_proj.urls'\n\nTEMPLATES = [\n    {\n        'BACKEND': 'django.template.backends.django.DjangoTemplates',\n        'DIRS': [],\n        'APP_DIRS': True,\n        'OPTIONS': {\n            'context_processors': [\n                'django.template.context_processors.debug',\n                'django.template.context_processors.request',\n                'django.contrib.auth.context_processors.auth',\n                'django.contrib.messages.context_processors.messages',\n            ],\n        },\n    },\n]\n\nWSGI_APPLICATION = 'todo_proj.wsgi.application'\n\n\n# Database\n# https:\/\/docs.djangoproject.com\/en\/3.2\/ref\/settings\/#databases\n\nimport os\n\nDATABASES = { \n'default': \n  { \n    'ENGINE': 'django.db.backends.postgresql', \n    'NAME': os.environ.get('DATABASE_NAME'), \n    'USER': os.environ.get('DATABASE_USER'), \n    'PASSWORD': os.environ.get('DATABASE_PASSWORD'),    \n    'HOST': os.environ.get('DATABASE_HOST'), \n    'PORT': os.environ.get('DATABASE_PORT'), \n  } \n}\n\n\n# Password validation\n# https:\/\/docs.djangoproject.com\/en\/3.2\/ref\/settings\/#auth-password-validators\n\nAUTH_PASSWORD_VALIDATORS = [\n    {\n        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',\n    },\n    {\n        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',\n    },\n    {\n        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',\n    },\n    {\n        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',\n    },\n]\n\n\n# Internationalization\n# https:\/\/docs.djangoproject.com\/en\/3.2\/topics\/i18n\/\n\nLANGUAGE_CODE = 'en-us'\n\nTIME_ZONE = 'UTC'\n\nUSE_I18N = True\n\nUSE_L10N = True\n\nUSE_TZ = True\n\n\n# Static files (CSS, JavaScript, Images)\n# https:\/\/docs.djangoproject.com\/en\/3.2\/howto\/static-files\/\n\nSTATIC_URL = '\/static\/'\n\n# Default primary key field type\n# https:\/\/docs.djangoproject.com\/en\/3.2\/ref\/settings\/#default-auto-field\n\nDEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'\n\nGRAPHENE = {\n  'SCHEMA': 'todo_proj.schema.schema',\n  'MIDDLEWARE': [\n    'graphql_jwt.middleware.JSONWebTokenMiddleware',\n   ],\n}\n\n<\/pre><\/div>\n\n\n
Also in the todo-app-graphql\/server\/todo_proj\/settings.py file add the AUTHENTICATION_BACKENDS setting:<\/p>\n\n\n
\n# todo-app-graphql\/server\/todo_proj\/settings.py\n\n# ... code\n\nAUTHENTICATION_BACKENDS = [\n  'graphql_jwt.backends.JSONWebTokenBackend',\n  'django.contrib.auth.backends.ModelBackend',\n]\n<\/pre><\/div>\n\n\n
In the todo-app-graphql\/server\/todo_proj\/schema.py file add:<\/p>\n\n\n
\n# todo-app-graphql\/server\/todo_proj\/schema.py\n\nimport graphene\nimport graphql_jwt\n\n# ...code\n<\/pre><\/div>\n\n\n
Also in the todo-app-graphql\/server\/todo_proj\/schema.py file change the Mutation class by replacing “pass” with the following variables:<\/p>\n\n\n
\n# todo-app-graphql\/server\/todo_proj\/schema.py\n\n# ... code\n\nclass Mutation(\n  users.schema.Mutation,\n  todo_app.schema.Mutation,\n  graphene.ObjectType\n):\n  token_auth = graphql_jwt.ObtainJSONWebToken.Field()\n  verify_token = graphql_jwt.Verify.Field()\n  refresh_token = graphql_jwt.Refresh.Field()\n\n# ... code\n<\/pre><\/div>\n\n\n
Your todo-app-graphql\/server\/todo_proj\/schema.py should look like this now. Note the highlighted lines for the updated code.<\/p>\n\n\n
\nimport graphene\nimport graphql_jwt\n \nimport todo_app.schema\nimport users.schema\n \nclass Query(\n  users.schema.Query,\n  todo_app.schema.Query,\n  graphene.ObjectType\n):\n  pass\n \nclass Mutation(users.schema.Mutation, todo_app.schema.Mutation, graphene.ObjectType):\n  token_auth = graphql_jwt.ObtainJSONWebToken.Field()\n  verify_token = graphql_jwt.Verify.Field()\n  refresh_token = graphql_jwt.Refresh.Field()\n \nschema = graphene.Schema(query=Query, mutation=Mutation)\n<\/pre><\/div>\n\n\n
Since we updated our settings.py file we need to reboot:<\/p>\n\n\n
\ndocker-compose down\ndocker-compose up -d\n<\/pre><\/div>\n\n\n
We have three new Mutations. The first, token_auth uses the User with its username and password to obtain its JSON Web token.<\/p>\n\n\n\n
Add the following mutation into graphiql:<\/p>\n\n\n
\nmutation {\n  tokenAuth(username: "ron", password: "123456A!") {\n    token\n  }\n}\n<\/pre><\/div>\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Using the returned token we will verify that the provided token is indeed for the user we requested.<\/p>\n\n\n\n
The token that is returned for you will be different from mine in the example below so you will need to use your token below.<\/p>\n\n\n
\nmutation {\n  verifyToken(token:   "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6InJvbiIsImV4cCI6MTYwMTg2NTU4Nywib3JpZ19pYXQiOjE2MDE4NjUyODd9.5sakOlY_sf3MJIEq_FXNtJexalgNi7VIejUTuo_Bvok") \n  {\n  payload\n  }\n}\n<\/pre><\/div>\n\n\n
Voila! VerifyToken confirms that the token is valid which is passed in as an argument.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
RefreshToken is used to obtain a new token within the renewed expiration time for non-expired tokens, if they are enabled to expire. We won’t be using this token.<\/p>\n\n\n\n
For more information check the documentation here<\/a>.<\/p>\n\n\n\n
Test Our Authentication<\/h4>\n\n\n\n
In order to test to see if everything is working, we create a new Query called me. This query returns the User’s info if the user is logged in or an error.<\/p>\n\n\n\n
Update server\/users\/schema.py file with the following highlighted lines:<\/p>\n\n\n
\n# server\/users\/schema.py\n\n\nfrom django.contrib.auth import get_user_model\nimport graphene\nfrom graphene_django import DjangoObjectType\n\nclass UserType(DjangoObjectType):\n  class Meta:\n    model = get_user_model()\n\nclass CreateUser(graphene.Mutation):\n  user = graphene.Field(UserType)\n\n  class Arguments:\n    username = graphene.String(required=True)\n    password = graphene.String(required=True)\n    email    = graphene.String(required=True)\n\n  def mutate(self, info, username, password, email):\n    user = get_user_model() (\n      username=username, \n      email = email,\n    )\n    user.set_password(password)\n    user.save()\n\n    return CreateUser(user=user)\n\nclass Mutation(graphene.ObjectType):\n  create_user = CreateUser.Field()\n\nclass Query(graphene.ObjectType):\n  me    = graphene.Field(UserType)\n  users = graphene.List(UserType)\n\n  def resolve_users(self, info):\n    return get_user_model().objects.all()\n\n  def resolve_me(self, info):\n    user = info.context.user\n    if user.is_anonymous:\n      raise Exception('Not logged in!')\n\n    return user\n<\/pre><\/div>\n\n\n
Now we need to switch from GraphiQL UI to a another app called Insomnia which can accept custom HTTP headers. You can download Insomnia here<\/a>.<\/p>\n\n\n\n
Using Insomnia let’s get a new token for our user:<\/p>\n\n\n
\nmutation {\n  tokenAuth(username: "ron", password: "123456A!") {\n    token\n  }\n}\n<\/pre><\/div>\n\n\n
… which gives us this.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Add the token under the Header tab on Insomnia, add the AUTHORIZATION HTTP header with our token prefixed with the word jwt.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Using our new token we can query the identity of our user that we just logged in.<\/p>\n\n\n
\nquery {\n  me {\n    id\n    username\n  }\n}\n<\/pre><\/div>\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Now we can create users and login with them.<\/p>\n\n\n\n
Integrating Todo Tasks and Users<\/h4>\n\n\n\n
Ok, where are we? We can login and access via Insomnia who is logged in. Excellent. What’s next? We don’t want anonymous users creating and editing todo tasks. Only logged in users can have that privilege so we need to link our users to todo tasks.<\/p>\n\n\n\n
We need update our todo model, todo-app-graphql\/todo_app\/models.py:<\/p>\n\n\n\n
# todo-app-graphql\/todo_app\/models.py\n\nfrom django.conf import settings\n# ... code<\/pre>\n\n\n\n
Add a posted_by field:<\/p>\n\n\n\n
# todo-app-graphql\/todo_app\/models.py\n\nfrom django.conf import settings\n# ... code\n\nclass Todo(models.Model):\n  title = models.CharField(max_length=5000)\n  task = models.TextField(blank=True)\n  slug = AutoSlugField(populate_from='title', default='')\n  category = TreeForeignKey('Category', on_delete=models.CASCADE, null=True, blank=True, related_name='todos')\n  project = models.ForeignKey('Project', related_name='todo_project', on_delete=models.CASCADE, null=True, blank=True)\n  is_completed = models.BooleanField(default=False)\n  posted_by = models.ForeignKey(settings.AUTH_USER_MODEL, null=True, on_delete=models.CASCADE)<\/span>\n  modified = models.DateTimeField(auto_now=True, null=True, editable=False)\n  created = models.DateField(default=timezone.now().strftime(\"%Y-%m-%d\"))\n  due_date = models.DateField(default=timezone.now().strftime(\"%Y-%m-%d\"))\n\n  def __str__(self):\n    return self.title<\/pre>\n\n\n\n
Using docker-compose run makemigrations and migrate to update our database:<\/p>\n\n\n
\n# Stop server\ndocker-compose down\n# Start server so new migrations take effect\ndocker-compose up -d\n\n# Migrations\ndocker-compose run server .\/manage.py makemigrations\ndocker-compose run server .\/manage.py migrate\n<\/pre><\/div>\n\n\n
In CreateTodo mutation, todo-app-graphql\/todo_app\/schema.py, return the User in the newly created field:<\/p>\n\n\n\n
# todo-app-graphql\/todo_app\/schema.py\n\n# ...code\nfrom users.schema import UserType<\/span>\n\n# ...code\n# Update CreateTodo mutation\nclass CreateTodo(graphene.Mutation):\n  id = graphene.Int()\n  title = graphene.String()\n  task = graphene.String()\n  is_completed = graphene.Boolean()\n  slug = graphene.String()\n  project = graphene.Field(ProjectType)\n  category = graphene.Field(CategoryType)\n  posted_by = graphene.Field(UserType)<\/span>\n\n  class Arguments:\n    title = graphene.String()\n    task = graphene.String()\n    projId = graphene.Int()\n    catId = graphene.Int()\n\n  def mutate(self, info, title, task, projId=None, catId=None):\n    user = info.context.user\n    if user.is_anonymous:\n      raise GraphQLError('You must be logged in to create new todos!')<\/span>\n\n    if projSlug:\n      proj = Project.objects.filter(slug=projSlug).first()\n    else:\n      proj = None\n\n    if catSlug:\n      cat = Category.objects.get(slug=catSlug)\n    else:\n      cat = None\n      \n    todo = Todo(\n      title=title, \n      task=task, \n      project=proj, \n      category=cat,\n      posted_by=user,<\/span>\n    )\n    todo.save()\n\n    return CreateTodo(\n      id=todo.id,\n      title=todo.title,\n      task=todo.task,\n      slug=todo.slug,\n      project=todo.project,\n      category=todo.category,\n      posted_by=todo.posted_by,<\/span>\n    )<\/pre>\n\n\n\n
Now we can test by sending a mutation to the server via GraphiQL, http:\/\/localhost:5555\/graphql:<\/p>\n\n\n\n
mutation {\n  createTodo(\n    title: \"My Todo\",\n    task: \"Do this task\u2026\",\n    projId: 1,\n    catId: 1\n  ) {\n      id\n      title\n      task\n      postedBy {\n        id\n        username\n        email\n    }\n    project {\n      id\n      name\n      slug\n    }\n    category {\n      id\n      name\n    }\n  }\n}<\/pre>\n\n\n\n
But wait we get an error!<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
If you didn’t get an error and you were successful in creating a todo, you may be logged into the django backend, (http:\/\/localhost:5555\/admin<\/a>), using the same browser.<\/p>\n\n\n\n
Our create todo mutation is now password protected. In order to create a new task via GraphQL we need to use Insomnia which sends our user token in the header:<\/p>\n\n\n\n
Note that since we are referencing projId and catId in the createTodo arguments each with id 1 so, confirm that you have a project and a category each with id = 1 in your db if not adjust the id parameter accordingly.<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Next we need to update \/server\/todo_app\/schema.py<\/strong> file by adding user authentication for update todo:<\/p>\n\n\n\n
# server\/todo_app\/schema.py\n\n# code...\n\nclass UpdateTodo(graphene.Mutation):\n  id = graphene.Int()\n  title = graphene.String()\n  task = graphene.String()\n  is_completed = graphene.Boolean()\n  project = graphene.Field(ProjectType)\n  category = graphene.Field(CategoryType)\n  slug = graphene.String()\n  posted_by = graphene.Field(UserType)<\/span>\n\n  class Arguments:\n    id = graphene.Int()\n    title = graphene.String()\n    task = graphene.String()\n    is_completed = graphene.Boolean()\n    projId = graphene.Int()\n    catId = graphene.Int()\n\n  def mutate(self, info, id, title=None, task=None, is_completed=None, projId=None, catId=None):\n\n    user = info.context.user\n    if user.is_anonymous:\n      raise GraphQLError('You must be logged in to execute this mutation!')<\/span>\n\n    todo = Todo.objects.get(pk=id)\n    if projId:\n      project = Project.objects.get(pk=projId)\n      if not project:\n        raise Exception('There is no project with this id.')\n\n    if catId:\n      category = Category.objects.get(pk=catId)\n      if not category:\n        raise Exception('No category with this id exists.')\n\n    if todo:\n      if title:\n        todo.title = title\n      if task:\n        todo.task = task\n      if is_completed:\n        todo.is_completed = is_completed\n      if projId:\n        todo.project = project\n      if catId:\n        todo.category = category\n\n      todo.save()\n\n      return UpdateTodo(\n        id = todo.id,\n        title = todo.title,\n        task = todo.task,\n        is_completed = todo.is_completed,\n        project = todo.project,\n        category = todo.category,\n        slug = todo.slug,\n        posted_by=todo.posted_by,<\/span>\n      )\n    else:\n      raise Exception('There is no todo with this id.')\n\n# code ...\nclass Mutation(graphene.ObjectType):\n  # code...\n  update_todo = UpdateTodo.Field()\n<\/pre>\n\n\n\n
Using Insomnia GraphQL we can update our Todo:<\/p>\n\n\n\n
mutation{\n  updateTodo(\n    id: 1,\n    title: \"todo1 updated\"\n  ) {\n    id\n    title\n    postedBy{\n      id\n      username\n      email\n    }\n  }\n}<\/pre>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
So now both create and updating todos are protected by user authentication. That’s fine allowing any authenticated user the permission for creating a new todo, but we only want the user who originally created the todo to be able to edit it. For that we need to add an additional layer of authentication testing that the logged in user is indeed the same as the user who created the todo.<\/p>\n\n\n\n
We can do this by comparing current user id and posted by id, e.g. user.id != posted_by.id. Lets add this to our UpdateTodo mutation below:<\/p>\n\n\n\n
# server\/todo_app\/schema.py\n\n# code...\n\nclass UpdateTodo(graphene.Mutation):\n  id = graphene.Int()\n  title = graphene.String()\n  task = graphene.String()\n  is_completed = graphene.Boolean()\n  project = graphene.Field(ProjectType)\n  category = graphene.Field(CategoryType)\n  slug = graphene.String()\n  posted_by = graphene.Field(UserType)\n\n  class Arguments:\n    id = graphene.Int()\n    title = graphene.String()\n    task = graphene.String()\n    is_completed = graphene.Boolean()\n    projId = graphene.Int()\n    catId = graphene.Int()\n\n  def mutate(self, info, id, title=None, task=None, is_completed=None, projId=None, catId=None):\n\n    user = info.context.user\n    if user.is_anonymous:\n      raise GraphQLError('You must be logged in to execute this mutation!')\n\n    todo = Todo.objects.get(pk=id)\n\n    # test if logged in user is the same as posted_by\n    if todo.posted_by.id != user.id:\n      raise GraphQLError('You do not have permission to execute this mutation!')<\/span>\n\n    if projId:\n      project = Project.objects.get(pk=projId)\n      if not project:\n        raise Exception('There is no project with this id.')\n\n    if catId:\n      category = Category.objects.get(pk=catId)\n      if not category:\n        raise Exception('No category with this id exists.')\n\n    if todo:\n      if title:\n        todo.title = title\n      if task:\n        todo.task = task\n      if is_completed:\n        todo.is_completed = is_completed\n      if projId:\n        todo.project = project\n      if catId:\n        todo.category = category\n\n      todo.save()\n\n      return UpdateTodo(\n        id = todo.id,\n        title = todo.title,\n        task = todo.task,\n        is_completed = todo.is_completed,\n        project = todo.project,\n        category = todo.category,\n        slug = todo.slug,\n        posted_by=todo.posted_by,\n      )\n    else:\n      raise Exception('There is no todo with this id.')\n<\/pre>\n\n\n\n
Now only the user who created the todo can edit it. Try it in Insomnia.<\/p>\n\n\n\n
Next we need to add user authentication for all Crud operations which the updated todo app schema and model addresses below.<\/p>\n\n\n\n
Updated for All Mutations for Todo App Schema<\/h4>\n\n\n\n
Below is updated schema including:<\/p>\n\n\n\n