Auth plugin values available in a resolver?

[PatricioNG]

I've got a builder set up using the AuthPlugin like this:

const Builder = new SchemaBuilder<PothosBuilderOptions>({
	plugins: [AuthPlugin, PothosZodPlugin, DirectivePlugin, FederationPlugin],
	scopeAuth: {
		authScopes: async (ctx) => ({
			user: !!ctx.currentUser?.id,
			admin: !!ctx.currentUser?.permissions.includes(GlobalConstants.Middleware.Auth.ADMIN_PERMISSION),
		}),
	},
	zod: {
		validationError: (zodError, _args, _context, _info) => {
			return zodError;
		},
	},
});

So two auth scopes exist in my app, user which would be any logged-in user, and admin which would be users that have a specific permission. In this scenario, is there any way to get the computed value of authScopes in a resolver?

ie:

Builder.queryField('myQuery', (t) =>
	t.field({
		type: MyType,
		authScopes: {
			user: true,
		},
		resolve: async (parent, args, ctx, info) => {
                           //Can we access this in any way, like this?
                           ctx.authScopes.admin ? console.log('user is an admin') : console.log('user is a user');
                }

I know technically currentUser exists in context so I can do the checks again, I'm just trying to reduce duplication on every query that is like the above - a query that is open to users and technically admins (as they pass the logged in user check) but we want to know generally if the user is also an admin

[hayes]

It's not part of the documented public API, but you can technically do something like:

import { RequestCache } from '@pothos/plugin-scope-auth'

const cache = RequestCache.fromContext(ctx)

const isAdmin = cache.get('admin')!.get(true)

the request cache isn't meant to be used in apps, and doesn't have the simple APIs you are probably looking for. Auth scopes aren't really just things like user or admin, they are the scope + value (admin: true) to support other patterns like role:admin where one scope name can be evaluated with different values.

What i'd do instead is extend your Context to have something like isAdmin, then both your auth scope and the resolver can both just use ctx.isAdmin instead. It doesn't look like your scope actually does anything that you would need to only calculate for requests where the scope is required, so moving it up into the context creation should be fine