node.js - What is a good pattern for implementing access control in a GraphQL server? -

background:

i have set of models, including user , various other models, of contain references user. exposing these models querying via graphql api generated graffiti, backed mongo database using graffiti-mongoose adaptor. current rest api (which migrating graphql) uses json web tokens authenticate users, , has custom permission logic on server side handle access control.

problem:

i'd restrict access objects in graphql based upon current logged-in user. models should accessible reads unauthenticated calls. other models should accessible user created them. what's best way manage access control objects via graffiti-generated api?

in general, there patterns of access control graphql? , in particular, there examples or libraries doing graffiti?

notes:

i understand pre- , post- hooks have been implemented graffiti-mongoose, , can used basic binary checks authentication. i'd see how more detailed access-control logic worked graphql api. in future, we'll want support things administrators have access model instances created group of users (e.g. users affiliations include of administrator).

typically graphql not handle access control directly, instead delegating responsibility whatever data system interfaces with. in case sounds mongoose.

since access control logic arbitrary logic (for example, has user been banned content? did publisher of content restrict custom privacy settings? etc.), , sounds in case access control logic in fact custom, should live in "resolve" function produces value graphql field.

for example:

var usertype = new graphqlobjecttype({   name: 'user',   fields: {     name: { type: graphqlstring },     birthday: {       type: graphqlstring,       resolve(user, context) {         var auth = context.myloggedinauth;         if (mycanauthseebirthday(auth, user)) {           return user.birthday;         }       }     }   } });