restrict graphiql to users that are signed in

goinvo · Jan 9, 2024 · c8672a3 · c8672a3
1 parent fed88be
commit c8672a3
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/config/routes.rb b/config/routes.rb
@@ -4,7 +4,10 @@
   end
 
   # if Rails.env.development?
-    mount GraphiQL::Rails::Engine, at: "/graphiql", graphql_path: "/graphql"
+    mount GraphiQL::Rails::Engine, at: "/graphiql", graphql_path: "/graphql", constraints: lambda { |request|
+      # only allow authenticated users
+      Passwordless::Session.exists?(id: request.session[:"passwordless_session_id--user"])
+    }
   # end
 
   post "/graphql", to: "graphql#execute"