# pp_graphql

One CSV per TypeScript GraphQL service. Each row is one `(operation_or_field × resource_type × action)` gating decision.

All files use the same six columns: `microservice, endpoint, resource_type, action, pp_authorization_method, source_file`. The `endpoint` column uses `query <op>` / `mutation <op>` for root operations and `TypeName.fieldName` for field-level directives.

## Coverage

| Service                       | Rows | Gating style                   | Notes                                                                                                              |
|-------------------------------|------|--------------------------------|--------------------------------------------------------------------------------------------------------------------|
| `graphql-neighbouring-rights` |  126 | Directive (`@ppCanPerform` / `@ppAllowedTenants`) | Heaviest GraphQL user. Mostly field-level directives (e.g. `NrContribution.evidence`). Defines the `view:basic` / `view:nr` / `view:accounting` action tier convention. |
| `graphql-account`             |    4 | Resolver-call                  | Mix of `get_authorized_tenants` (root queries) + `is_authorized` (field resolvers like `Vendor.sonyFinancialMetadata`). |
| `graphql-knowledge-search`    |    1 | Resolver-call                  | One `get_authorized_tenants` call on `query globalParticipantSearchESxPP`.                                         |
| **Total**                     | **131** |                              |                                                                                                                    |

## Directive → method mapping

| Directive             | `pp_authorization_method`  | Behavior                                                                                       |
|-----------------------|----------------------------|------------------------------------------------------------------------------------------------|
| `@ppCanPerform`       | `is_authorized`            | Runs allowed-tenants check; raises `GraphQLError` if 0 tenants.                                |
| `@ppAllowedTenants`   | `get_authorized_tenants`   | Same fetch, doesn't raise — resolver code uses the cached tenant set to filter results.        |

## Column reference

All CSVs in this dir share the same six columns:

| Column                    | Meaning                                                                                                                                                                                                                  |
|---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `microservice`            | GraphQL service repo slug (e.g. `graphql-account`). Same value for every row in a file.                                                                                                                                 |
| `endpoint`                | The GraphQL gating target. One of three forms: `query <opName>` (root query), `mutation <opName>` (root mutation), or `<TypeName>.<fieldName>` (field-level directive or field resolver). No HTTP method/path — GraphQL doesn't have one. |
| `resource_type`           | The cerbos resource type checked. From the directive's `resource:` arg or the SDK call's first arg.                                                                                                                     |
| `action`                  | The cerbos action checked. From the directive's `action:` arg or the SDK call's second arg. Often colon-namespaced (`view:basic`, `view:nr`).                                                                          |
| `pp_authorization_method` | `is_authorized` for `@ppCanPerform` and direct `isAuthorized(...)` calls; `get_authorized_tenants` for `@ppAllowedTenants` and direct `getAuthorizedTenants(...)` calls.                                                |
| `source_file`             | For directive rows: `src/schema/<file>.graphql:<line>` of the directive application. For resolver rows: `src/resolvers/<file>.ts:<line>` or `src/connectors/<file>.ts:<line>` of the SDK call.                          |

## Patterns observed

- **Directive-based** (graphql-neighbouring-rights): declarative `*.graphql` schema annotations. Lowest boilerplate, easiest to audit.
- **Resolver-based** (graphql-account, graphql-knowledge-search): direct `pdpAuthorizationBackend.isAuthorized(...)` / `getAuthorizedTenants(...)` calls in `src/resolvers/` or `src/connectors/`. Required when the gate depends on resolver-local context.

A single service can mix both styles. graphql-account uses `get_authorized_tenants` in connectors and `is_authorized` in field resolvers without directives.