Cannot use @PreAuthorize annotation.

[und3rs]

I'm tring to add @PreAuthorize annotation at my Query function like this.

@PreAuthorize("hasRole('USER')")
suspend fun mockWeapons(): List<Workspace> {
    return workspaceService.getWorkspaces("04qVL9uwnhZo4WF8FVR4fiO")
}

However authentication instance is always the default anonomous with the role as 'ROLE_ANONYMOUS'.
Do you have any good idea?

Or what is the best solution to adding authentication/authorization feature?

Thank you for your help.

[smyrick]

The methods that generate the schema are not being executed by Spring, they are being called by the GraphQL schema object and engine. This means that the spring annotations won't work out of the box. You will need to use the context factory to properly read and parse and authorization headers.

But this brings up a good question because it looks like graphql-spring-boot-starter can support the spring annotations, so I wonder how they are passing down the correct context

https://dimitr.im/graphql-spring-security

https://github.com/graphql-java-kickstart/graphql-spring-boot