feat(query-graphql): expose computeAuthorizationFilter on Authorizer

packages/query-graphql/__tests__/__fixtures__/test-resolver.authorizer.ts

@@ -13,4 +13,8 @@ export class TestResolverAuthorizer implements Authorizer<TestResolverDTO> {
   authorizeRelation<Relation>(): Promise<Filter<Relation>> {
     return Promise.reject(new Error('authorizeRelation Not Implemented'))
   }
+
+  computeAuthorizationFilter(): Promise<Filter<TestResolverDTO>> {
+    return Promise.reject(new Error('computeAuthorizationFilter Not Implemented'))
+  }
 }

packages/query-graphql/__tests__/auth/default-crud-auth.service.spec.ts

@@ -126,6 +126,21 @@ describe('createDefaultAuthorizer', () => {
     expect(filter).toEqual({ ownerId: { eq: 2 } })
   })
 
+  it('should expose computeAuthorizationFilter as a public alias of authorize', async () => {
+    const authorizer = testingModule.get<Authorizer<TestDTO>>(getAuthorizerToken(TestDTO))
+    const context = { user: { id: 7 } }
+    const authzCtx: AuthorizationContext = {
+      operationName: 'queryMany',
+      operationGroup: OperationGroup.READ,
+      readonly: true,
+      many: true
+    }
+    const viaAuthorize = await authorizer.authorize(context, authzCtx)
+    const viaCompute = await authorizer.computeAuthorizationFilter(context, authzCtx)
+    expect(viaCompute).toEqual(viaAuthorize)
+    expect(viaCompute).toEqual({ ownerId: { eq: 7 } })
+  })
+
   it('should create an auth filter that depends on the passed operation name', async () => {
     const authorizer = testingModule.get<Authorizer<TestDTO>>(getAuthorizerToken(TestDTO))
     const filter = await authorizer.authorize(

packages/query-graphql/src/auth/authorizer.ts

@@ -44,4 +44,16 @@ export interface Authorizer<DTO> extends CustomAuthorizer<DTO> {
     context: any,
     authorizerContext: AuthorizationContext
   ): Promise<Filter<unknown> | undefined>
+
+  /**
+   * Compute the authorization filter the `@Authorize` pipeline would apply for
+   * the given context and operation. Intended for consumers outside the
+   * resolver pipeline (custom resolvers, domain services) so they can reuse
+   * the same `Filter<DTO>` the generated CRUD resolvers use.
+   */
+  computeAuthorizationFilter(
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    context: any,
+    authorizerContext: AuthorizationContext
+  ): Promise<Filter<DTO>>
 }

packages/query-graphql/src/auth/default-crud.authorizer.ts

@@ -12,15 +12,22 @@ export interface AuthorizerOptions<DTO> {
   authorize: (context: any, authorizationContext: AuthorizationContext) => Filter<DTO> | Promise<Filter<DTO>>
 }
 
-const createRelationAuthorizer = (opts: AuthorizerOptions<unknown>): Authorizer<unknown> => ({
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  async authorize(context: any, authorizationContext: AuthorizationContext): Promise<Filter<unknown>> {
-    return opts.authorize(context, authorizationContext) ?? {}
-  },
-  authorizeRelation(): Promise<Filter<unknown>> {
-    return Promise.reject(new Error('Not implemented'))
+const createRelationAuthorizer = (opts: AuthorizerOptions<unknown>): Authorizer<unknown> => {
+  const relationAuthorizer: Authorizer<unknown> = {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    async authorize(context: any, authorizationContext: AuthorizationContext): Promise<Filter<unknown>> {
+      return opts.authorize(context, authorizationContext) ?? {}
+    },
+    authorizeRelation(): Promise<Filter<unknown>> {
+      return Promise.reject(new Error('Not implemented'))
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    computeAuthorizationFilter(context: any, authorizationContext: AuthorizationContext): Promise<Filter<unknown>> {
+      return relationAuthorizer.authorize(context, authorizationContext)
+    }
   }
-})
+  return relationAuthorizer
+}
 
 export function createDefaultAuthorizer<DTO>(
   DTOClass: Class<DTO>,
@@ -51,6 +58,14 @@ export function createDefaultAuthorizer<DTO>(
       )
     }
 
+    computeAuthorizationFilter(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      context: any,
+      authorizationContext: AuthorizationContext
+    ): Promise<Filter<DTO>> {
+      return this.authorize(context, authorizationContext)
+    }
+
     async authorizeRelation(
       relationName: string,
       // eslint-disable-next-line @typescript-eslint/no-explicit-any