GraphQL API: Site Permissions

[NuckChorris]

What

mutation {
  account {
    setSitePermissions(input: { accountId: "5554", permissions: [ADMIN] }) {
      account {
        id
        permissions
      }
    }
  }
}

Why

Whenever we add and remove moderators, I have to pop into a rails console to manually do it. This is the first step to on-site permission management.

Checklist

• All files pass Rubocop
• Any complex logic is commented
• Any new systems have thorough documentation
• Any user-facing changes are behind a feature flag (or: explain why they can't be)

• All the tests pass
• Tests have been added to cover the new code

[toyhammered]

couple small questions, but love it!

[codeclimate]

Code Climate has analyzed commit 62ad2f3 and detected 0 issues on this pull request.

View more on Code Climate.

[toyhammered]

Some questions, but looks good for the most part!

[toyhammered]

What type of errors can happen here and should we account for them?

[NuckChorris]

UnknownPermissions could happen due to a programming error but otherwise it won't happen, and the only other ones are RecordNotFound or RecordInvalid which I believe are accounted for automatically

[toyhammered]

Do we want this here, or inside the mutation?

[NuckChorris]

Here, because we use it in authorized?

[toyhammered]

Ooooh, I see what you've done. If you want to go that route shouldn't we rename the value argument to id to be more specific?

Also unless I am thinking of this wrong from the load_account it takes what that returns and passes that along to the authorized? method (which would be a user) not an input?

I'll test this locally tomorrow because either this won't work at all or you are about to teach me something new (and I'm hoping it is the latter because this really opens up the possibilities).

[NuckChorris]

I don't think I'm doing anything weird, I'm pretty sure I've just copied it from your stuff… my thinking is that this should run on the input type to load the record and then when authorized? runs it's available as input.account

[toyhammered]

So the load_* isn't actually related to an input. Its the graphql-ruby gem magic and it must be in the mutation file itself.