migrate-permissions

name	migrate-permissions
description	Guide for moving inline auth checks out of GraphQL resolvers and into permissions.ts using graphql-shield rules. Use when adding, reviewing, or migrating authorization logic for mutations or queries.

Permissions

Authorization lives in two places: graphql/public/permissions.ts (preferred) and inline in resolver functions (legacy). The goal is to move all auth into permissions.ts.

How it works

permissions.ts exports a permissionMap that maps GraphQL types/fields to shield rules. composeResolvers.ts wraps each resolver with its rule as a higher-order function — avoiding the overhead of graphql-middleware.

• '*' wildcard sets a default rule for all fields on a type (e.g., all Mutations default to isAuthenticated)
• Specific field entries override the wildcard
• Rules can be composed with and(), or(), not() from graphql-shield

Rules directory: graphql/public/rules/

Rule	What it checks
isAuthenticated	viewer has a valid auth token
isSuperUser	viewer has su role
isTeamMember	authToken.tms includes the teamId (fast, no DB)
isViewerTeamLead	viewer has isLead on the team member record (DB)