Craft GraphQL APIs in Elixir with Absinthe/

...

/

Handling Input

Handling Input

Learn how to handle input that comes from the forms.

We'll cover the following...

Manage user input

The main administrative feature we want is the ability to look at the order history for each of the menu items we have listed here. This isn’t the kind of thing that should be visible to just anyone, so we need to take some steps to secure the UI. We already know how to secure portions of your GraphQL schema, but we’ll learn how to hook that up to the kinds of session mechanisms we use when doing server-driven UIs. It’ll also be a good first intro to handling input that comes from the forms. When working with normal browser-based interfaces, we’ll need a way to put authentication information into the session cookie managed by Plug. After a successful login, user information will be placed into the cookie, and then that cookie will get pushed along in every subsequent request. In the Login API, we created a plug to handle retrieving auth information from headers. We’ll create a similar plug for our admin scope. It’s possible to refactor the existing plug to handle both the API and the admin interface. However, there’s enough distinct logic that it’s cleaner to create a new one:

Press + to interact
defmodule PlateSlateWeb.AdminAuth do
   @behaviour Plug
   import Plug.Conn
   def init(opts), do: opts
   def call(conn, _) do
     with id when not is_nil(id) <- get_session(conn, :employee_id), 
     %{} = user <- PlateSlate.Accounts.lookup("employee", id) do
       conn
       |> Plug.Conn.assign(:current_user, user)
       |> Absinthe.Plug.put_options(context: %{current_user: user})
    else
       _ -> 
       conn
        |> clear_session
        |> Phoenix.Controller.redirect(to: "/admin/session/new") 
     end
   end 
end

Instead of looking at the headers, we use ...