feat: Add authorization rules to user email object type (#863)

kingston · web-flow · commit eec498b152c7 · 2026-03-23T11:39:04.000+01:00
diff --git a/.changeset/add-user-email-authorization.md b/.changeset/add-user-email-authorization.md
@@ -0,0 +1,5 @@
+---
+'@baseplate-dev/plugin-auth': patch
+---
+
+Add authorization rules to the User model's email field in both Better Auth and Placeholder Auth plugins, restricting email visibility to admins and the user themselves (via a new "self" instance role)
diff --git a/examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.authorizer.ts b/examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.authorizer.ts
@@ -5,5 +5,5 @@ export const userAuthorizer = createModelAuthorizer({
   model: 'user',
   idField: 'id',
   getModelById: (id) => prisma.user.findUnique({ where: { id } }),
-  roles: { owner: (ctx, model) => model.id === ctx.auth.userId },
+  roles: { self: (ctx, model) => model.id === ctx.auth.userId },
 });
diff --git a/examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.query-filter.ts b/examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.query-filter.ts
@@ -3,6 +3,6 @@ import { createModelQueryFilter } from '@src/utils/query-filters.js';
 export const userQueryFilter = createModelQueryFilter({
   model: 'user',
   roles: {
-    owner: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
+    self: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
   },
 });
diff --git a/examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/accounts/users/schema/user.object-type.ts b/examples/blog-with-auth/apps/backend/baseplate/generated/src/modules/accounts/users/schema/user.object-type.ts
@@ -6,7 +6,7 @@ export const userObjectType = builder.prismaObject('User', {
   fields: (t) => ({
     id: t.exposeID('id'),
     email: t.exposeString('email', {
-      authorize: ['admin', userAuthorizer.roles.owner],
+      authorize: ['admin', userAuthorizer.roles.self],
       nullable: true,
     }),
     name: t.exposeString('name', { nullable: true }),
diff --git a/examples/blog-with-auth/apps/backend/src/modules/accounts/users/authorizers/user.authorizer.ts b/examples/blog-with-auth/apps/backend/src/modules/accounts/users/authorizers/user.authorizer.ts
@@ -5,5 +5,5 @@ export const userAuthorizer = createModelAuthorizer({
   model: 'user',
   idField: 'id',
   getModelById: (id) => prisma.user.findUnique({ where: { id } }),
-  roles: { owner: (ctx, model) => model.id === ctx.auth.userId },
+  roles: { self: (ctx, model) => model.id === ctx.auth.userId },
 });
diff --git a/examples/blog-with-auth/apps/backend/src/modules/accounts/users/authorizers/user.query-filter.ts b/examples/blog-with-auth/apps/backend/src/modules/accounts/users/authorizers/user.query-filter.ts
@@ -3,6 +3,6 @@ import { createModelQueryFilter } from '@src/utils/query-filters.js';
 export const userQueryFilter = createModelQueryFilter({
   model: 'user',
   roles: {
-    owner: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
+    self: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
   },
 });
diff --git a/examples/blog-with-auth/apps/backend/src/modules/accounts/users/schema/user.object-type.ts b/examples/blog-with-auth/apps/backend/src/modules/accounts/users/schema/user.object-type.ts
@@ -6,7 +6,7 @@ export const userObjectType = builder.prismaObject('User', {
   fields: (t) => ({
     id: t.exposeID('id'),
     email: t.exposeString('email', {
-      authorize: ['admin', userAuthorizer.roles.owner],
+      authorize: ['admin', userAuthorizer.roles.self],
       nullable: true,
     }),
     name: t.exposeString('name', { nullable: true }),
diff --git a/examples/blog-with-auth/baseplate/project-definition.json b/examples/blog-with-auth/baseplate/project-definition.json
@@ -614,8 +614,8 @@
         "roles": [
           {
             "expression": "model.id === userId",
-            "id": "model-authorizer-role:blog-user-owner",
-            "name": "owner"
+            "id": "model-authorizer-role:BjC0i357yrgp",
+            "name": "self"
           }
         ]
       },
@@ -632,7 +632,7 @@
             { "ref": "id" },
             {
               "globalRoles": ["admin"],
-              "instanceRoles": ["owner"],
+              "instanceRoles": ["self"],
               "ref": "email"
             },
             { "ref": "name" },
diff --git a/examples/blog-with-auth/pnpm-lock.yaml b/examples/blog-with-auth/pnpm-lock.yaml
diff --git a/examples/todo-with-better-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.authorizer.ts b/examples/todo-with-better-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.authorizer.ts
@@ -5,5 +5,5 @@ export const userAuthorizer = createModelAuthorizer({
   model: 'user',
   idField: 'id',
   getModelById: (id) => prisma.user.findUnique({ where: { id } }),
-  roles: { owner: (ctx, model) => model.id === ctx.auth.userId },
+  roles: { self: (ctx, model) => model.id === ctx.auth.userId },
 });
diff --git a/examples/todo-with-better-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.query-filter.ts b/examples/todo-with-better-auth/apps/backend/baseplate/generated/src/modules/accounts/users/authorizers/user.query-filter.ts
@@ -3,6 +3,6 @@ import { createModelQueryFilter } from '@src/utils/query-filters.js';
 export const userQueryFilter = createModelQueryFilter({
   model: 'user',
   roles: {
-    owner: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
+    self: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
   },
 });
diff --git a/examples/todo-with-better-auth/apps/backend/baseplate/generated/src/modules/accounts/users/schema/user.object-type.ts b/examples/todo-with-better-auth/apps/backend/baseplate/generated/src/modules/accounts/users/schema/user.object-type.ts
@@ -1,10 +1,14 @@
 import { builder } from '@src/plugins/graphql/builder.js';
 
+import { userAuthorizer } from '../authorizers/user.authorizer.js';
+
 export const userObjectType = builder.prismaObject('User', {
   fields: (t) => ({
     id: t.exposeID('id'),
     name: t.exposeString('name'),
-    email: t.exposeString('email'),
+    email: t.exposeString('email', {
+      authorize: ['admin', userAuthorizer.roles.self],
+    }),
     updatedAt: t.expose('updatedAt', { type: 'DateTime' }),
     createdAt: t.expose('createdAt', { type: 'DateTime' }),
     customer: t.relation('customer', { nullable: true }),
diff --git a/examples/todo-with-better-auth/apps/backend/src/modules/accounts/users/authorizers/user.authorizer.ts b/examples/todo-with-better-auth/apps/backend/src/modules/accounts/users/authorizers/user.authorizer.ts
@@ -5,5 +5,5 @@ export const userAuthorizer = createModelAuthorizer({
   model: 'user',
   idField: 'id',
   getModelById: (id) => prisma.user.findUnique({ where: { id } }),
-  roles: { owner: (ctx, model) => model.id === ctx.auth.userId },
+  roles: { self: (ctx, model) => model.id === ctx.auth.userId },
 });
diff --git a/examples/todo-with-better-auth/apps/backend/src/modules/accounts/users/authorizers/user.query-filter.ts b/examples/todo-with-better-auth/apps/backend/src/modules/accounts/users/authorizers/user.query-filter.ts
@@ -3,6 +3,6 @@ import { createModelQueryFilter } from '@src/utils/query-filters.js';
 export const userQueryFilter = createModelQueryFilter({
   model: 'user',
   roles: {
-    owner: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
+    self: (ctx) => (ctx.auth.userId != null ? { id: ctx.auth.userId } : false),
   },
 });
diff --git a/examples/todo-with-better-auth/apps/backend/src/modules/accounts/users/schema/user.object-type.ts b/examples/todo-with-better-auth/apps/backend/src/modules/accounts/users/schema/user.object-type.ts
@@ -1,10 +1,14 @@
 import { builder } from '@src/plugins/graphql/builder.js';
 
+import { userAuthorizer } from '../authorizers/user.authorizer.js';
+
 export const userObjectType = builder.prismaObject('User', {
   fields: (t) => ({
     id: t.exposeID('id'),
     name: t.exposeString('name'),
-    email: t.exposeString('email'),
+    email: t.exposeString('email', {
+      authorize: ['admin', userAuthorizer.roles.self],
+    }),
     updatedAt: t.expose('updatedAt', { type: 'DateTime' }),
     createdAt: t.expose('createdAt', { type: 'DateTime' }),
     customer: t.relation('customer', { nullable: true }),
diff --git a/examples/todo-with-better-auth/baseplate/project-definition.json b/examples/todo-with-better-auth/baseplate/project-definition.json
@@ -1382,8 +1382,8 @@
         "roles": [
           {
             "expression": "model.id === userId",
-            "id": "model-authorizer-role:e5NV7nPN9Flw",
-            "name": "owner"
+            "id": "model-authorizer-role:rlm2eb1GAtLh",
+            "name": "self"
           }
         ]
       },
@@ -1399,7 +1399,11 @@
           "fields": [
             { "ref": "id" },
             { "ref": "name" },
-            { "ref": "email" },
+            {
+              "globalRoles": ["admin"],
+              "instanceRoles": ["self"],
+              "ref": "email"
+            },
             { "ref": "updatedAt" },
             { "ref": "createdAt" }
           ],
diff --git a/examples/todo-with-better-auth/pnpm-lock.yaml b/examples/todo-with-better-auth/pnpm-lock.yaml
diff --git a/plugins/plugin-auth/src/better-auth/core/schema/models.ts b/plugins/plugin-auth/src/better-auth/core/schema/models.ts
@@ -59,9 +59,24 @@ export function createBetterAuthPartialDefinition(
         graphql: {
           objectType: {
             enabled: true,
-            fields: [{ ref: 'id' }, { ref: 'email' }],
+            fields: [
+              { ref: 'id' },
+              {
+                ref: 'email',
+                globalRoles: ['admin'],
+                instanceRoles: ['self'],
+              },
+            ],
           },
         },
+        authorizer: {
+          roles: [
+            {
+              name: 'self',
+              expression: 'model.id === userId',
+            },
+          ],
+        },
       },
       {
         name: BETTER_AUTH_MODELS.session,
diff --git a/plugins/plugin-auth/src/local-auth/core/schema/models.ts b/plugins/plugin-auth/src/local-auth/core/schema/models.ts
@@ -53,9 +53,24 @@ export function createLocalAuthPartialDefinition(
         graphql: {
           objectType: {
             enabled: true,
-            fields: [{ ref: 'id' }, { ref: 'email' }],
+            fields: [
+              { ref: 'id' },
+              {
+                ref: 'email',
+                globalRoles: ['admin'],
+                instanceRoles: ['self'],
+              },
+            ],
           },
         },
+        authorizer: {
+          roles: [
+            {
+              name: 'self',
+              expression: 'model.id === userId',
+            },
+          ],
+        },
       },
       {
         name: LOCAL_AUTH_MODELS.userAccount,
diff --git a/plugins/plugin-auth/src/placeholder-auth/core/schema/models.ts b/plugins/plugin-auth/src/placeholder-auth/core/schema/models.ts
@@ -33,9 +33,24 @@ export function createPlaceholderAuthPartialDefinition(
         graphql: {
           objectType: {
             enabled: true,
-            fields: [{ ref: 'id' }, { ref: 'email' }],
+            fields: [
+              { ref: 'id' },
+              {
+                ref: 'email',
+                globalRoles: ['admin'],
+                instanceRoles: ['self'],
+              },
+            ],
           },
         },
+        authorizer: {
+          roles: [
+            {
+              name: 'self',
+              expression: 'model.id === userId',
+            },
+          ],
+        },
       },
     ],
   };
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +'@baseplate-dev/plugin-auth': patch
 +---
++
 +Add authorization rules to the User model's email field in both Better Auth and Placeholder Auth plugins, restricting email visibility to admins and the user themselves (via a new "self" instance role)
Original file line number	Diff line number	Diff line change
`@@ -614,8 +614,8 @@`
`614`	`614`	`"roles": [`
`615`	`615`	`{`
`616`	`616`	`"expression": "model.id === userId",`
`617`		`- "id": "model-authorizer-role:blog-user-owner",`
`618`		`- "name": "owner"`
	`617`	`+ "id": "model-authorizer-role:BjC0i357yrgp",`
	`618`	`+ "name": "self"`
`619`	`619`	`}`
`620`	`620`	`]`
`621`	`621`	`},`
`@@ -632,7 +632,7 @@`
`632`	`632`	`{ "ref": "id" },`
`633`	`633`	`{`
`634`	`634`	`"globalRoles": ["admin"],`
`635`		`- "instanceRoles": ["owner"],`
	`635`	`+ "instanceRoles": ["self"],`
`636`	`636`	`"ref": "email"`
`637`	`637`	`},`
`638`	`638`	`{ "ref": "name" },`