Skip to content

docs(router): Add authorization documentation and specification #7302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 6 commits into from
Nov 28, 2025
Merged

docs(router): Add authorization documentation and specification #7302

merged 6 commits into from
Nov 28, 2025

Conversation

@kamilkisiela
Copy link
Contributor

@kamilkisiela kamilkisiela commented Nov 21, 2025 •
edited
Loading

@kamilkisiela kamilkisiela added the waiting-on:router-release Do not merge: waiting for Router release that includes this feature. label Nov 21, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Nov 21, 2025 •
edited
Loading

📚 Storybook Deployment

The latest changes are available as preview in: https://pr-7302.hive-storybook.pages.dev

@github-actions
Copy link
Contributor

github-actions bot commented Nov 21, 2025 •
edited
Loading

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package Version Info
@graphql-hive/cli 0.54.0-alpha-20251126085033-5c34e961a70147b83210030edbcfd63a64459e8a npm ↗︎ unpkg ↗︎
hive 8.10.0-alpha-20251126085033-5c34e961a70147b83210030edbcfd63a64459e8a npm ↗︎ unpkg ↗︎

@github-actions
Copy link
Contributor

github-actions bot commented Nov 21, 2025 •
edited
Loading

💻 Website Preview

The latest changes are available as preview in: https://pr-7302.hive-landing-page.pages.dev

@github-actions
Copy link
Contributor

github-actions bot commented Nov 21, 2025 •
edited
Loading

🐋 This PR was built and pushed to the following Docker images:

Targets: build

Platforms: linux/amd64

Image Tag: 5c34e961a70147b83210030edbcfd63a64459e8a

Docker Bake metadata 
{
"app": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/api/health",
          "build-arg:IMAGE_DESCRIPTION": "The app of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/app",
          "build-arg:PORT": "3000",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/app",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/11o1jq5e0dmufwtqry4mvj66z",
  "containerimage.config.digest": "sha256:94df1f7f07c8e49a8c1e6feab9bd86f1e90aab065c6e22a76a8f179e64534441",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:ddd2e2c123467b5418996c743f2c2580e21b104f03f961fc9d8e10c93a55de51",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:ddd2e2c123467b5418996c743f2c2580e21b104f03f961fc9d8e10c93a55de51",
  "image.name": "ghcr.io/graphql-hive/app:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/app:kamil_router_docs_auth-amd64"
},
"buildx.build.warnings": [
  {
    "vertex": "sha256:3618f71764d3a6cfff3331c54597ef642a21112323a6115f4377926ae814645e",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRJTUFHRV9ERVNDUklQVElPTicgKGxpbmUgMTQp",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "services.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSB3Z2V0IGNhLWNlcnRpZmljYXRlcyAmJiBybSAtcmYgL3Zhci9saWIvYXB0L2xpc3RzLyoKCkFSRyBTRVJWSUNFX0RJUl9OQU1FCldPUktESVIgL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UubGljZW5zZXM9TUlUCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZT0kSU1BR0VfVElUTEUKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249JFJFTEVBU0UKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPSRJTUFHRV9ERVNDUklQVElPTgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYXV0aG9ycz0iVGhlIEd1aWxkIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPSJLYW1pbCBLaXNpZWxhIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgoKRU5WIEVOVklST05NRU5UPXByb2R1Y3Rpb24KRU5WIFJFTEVBU0U9JFJFTEVBU0UKRU5WIFBPUlQ9JFBPUlQKCkhFQUxUSENIRUNLIC0taW50ZXJ2YWw9NXMgXAogIC0tdGltZW91dD01cyBcCiAgLS1zdGFydC1wZXJpb2Q9NXMgXAogIC0tcmV0cmllcz02IFwKICBDTUQgJEhFQUxUSENIRUNLX0NNRAoKRU5UUllQT0lOVCBbICIvZW50cnlwb2ludC5zaCIgXQo=",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 14
        },
        "end": {
          "line": 14
        }
      }
    ]
  },
  {
    "vertex": "sha256:3618f71764d3a6cfff3331c54597ef642a21112323a6115f4377926ae814645e",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRSRUxFQVNFJyAobGluZSAyMSk=",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "services.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSB3Z2V0IGNhLWNlcnRpZmljYXRlcyAmJiBybSAtcmYgL3Zhci9saWIvYXB0L2xpc3RzLyoKCkFSRyBTRVJWSUNFX0RJUl9OQU1FCldPUktESVIgL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UubGljZW5zZXM9TUlUCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZT0kSU1BR0VfVElUTEUKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249JFJFTEVBU0UKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPSRJTUFHRV9ERVNDUklQVElPTgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYXV0aG9ycz0iVGhlIEd1aWxkIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPSJLYW1pbCBLaXNpZWxhIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgoKRU5WIEVOVklST05NRU5UPXByb2R1Y3Rpb24KRU5WIFJFTEVBU0U9JFJFTEVBU0UKRU5WIFBPUlQ9JFBPUlQKCkhFQUxUSENIRUNLIC0taW50ZXJ2YWw9NXMgXAogIC0tdGltZW91dD01cyBcCiAgLS1zdGFydC1wZXJpb2Q9NXMgXAogIC0tcmV0cmllcz02IFwKICBDTUQgJEhFQUxUSENIRUNLX0NNRAoKRU5UUllQT0lOVCBbICIvZW50cnlwb2ludC5zaCIgXQo=",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 21
        },
        "end": {
          "line": 21
        }
      }
    ]
  },
  {
    "vertex": "sha256:3618f71764d3a6cfff3331c54597ef642a21112323a6115f4377926ae814645e",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRQT1JUJyAobGluZSAyMik=",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "services.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSB3Z2V0IGNhLWNlcnRpZmljYXRlcyAmJiBybSAtcmYgL3Zhci9saWIvYXB0L2xpc3RzLyoKCkFSRyBTRVJWSUNFX0RJUl9OQU1FCldPUktESVIgL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UubGljZW5zZXM9TUlUCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZT0kSU1BR0VfVElUTEUKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249JFJFTEVBU0UKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPSRJTUFHRV9ERVNDUklQVElPTgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYXV0aG9ycz0iVGhlIEd1aWxkIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPSJLYW1pbCBLaXNpZWxhIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgoKRU5WIEVOVklST05NRU5UPXByb2R1Y3Rpb24KRU5WIFJFTEVBU0U9JFJFTEVBU0UKRU5WIFBPUlQ9JFBPUlQKCkhFQUxUSENIRUNLIC0taW50ZXJ2YWw9NXMgXAogIC0tdGltZW91dD01cyBcCiAgLS1zdGFydC1wZXJpb2Q9NXMgXAogIC0tcmV0cmllcz02IFwKICBDTUQgJEhFQUxUSENIRUNLX0NNRAoKRU5UUllQT0lOVCBbICIvZW50cnlwb2ludC5zaCIgXQo=",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 22
        },
        "end": {
          "line": 22
        }
      }
    ]
  },
  {
    "vertex": "sha256:3df27fd26c52e83275deea27f36b7726bd4ed697129430dd9ae040ab9817c8ab",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRSRUxFQVNFJyAobGluZSAxMik=",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "migrations.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSBjYS1jZXJ0aWZpY2F0ZXMKCldPUktESVIgL3Vzci9zcmMvYXBwCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpFTlYgRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgpFTlYgTk9ERV9FTlY9cHJvZHVjdGlvbgpFTlYgUkVMRUFTRT0kUkVMRUFTRQoKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmxpY2Vuc2VzPU1JVApMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudGl0bGU9JElNQUdFX1RJVExFCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS52ZXJzaW9uPSRSRUxFQVNFCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5kZXNjcmlwdGlvbj0kSU1BR0VfREVTQ1JJUFRJT04KTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmF1dGhvcnM9IlRoZSBHdWlsZCIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlbmRvcj0iS2FtaWwgS2lzaWVsYSIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybD0iaHR0cHM6Ly9naXRodWIuY29tL2dyYXBocWwtaGl2ZS9wbGF0Zm9ybSIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnNvdXJjZT0iaHR0cHM6Ly9naXRodWIuY29tL2dyYXBocWwtaGl2ZS9wbGF0Zm9ybSIKCkVOVFJZUE9JTlQgWyAiL2VudHJ5cG9pbnQuc2giIF0K",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 12
        },
        "end": {
          "line": 12
        }
      }
    ]
  },
  {
    "vertex": "sha256:3df27fd26c52e83275deea27f36b7726bd4ed697129430dd9ae040ab9817c8ab",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRJTUFHRV9USVRMRScgKGxpbmUgMTUp",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "migrations.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSBjYS1jZXJ0aWZpY2F0ZXMKCldPUktESVIgL3Vzci9zcmMvYXBwCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpFTlYgRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgpFTlYgTk9ERV9FTlY9cHJvZHVjdGlvbgpFTlYgUkVMRUFTRT0kUkVMRUFTRQoKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmxpY2Vuc2VzPU1JVApMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudGl0bGU9JElNQUdFX1RJVExFCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS52ZXJzaW9uPSRSRUxFQVNFCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5kZXNjcmlwdGlvbj0kSU1BR0VfREVTQ1JJUFRJT04KTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmF1dGhvcnM9IlRoZSBHdWlsZCIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlbmRvcj0iS2FtaWwgS2lzaWVsYSIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybD0iaHR0cHM6Ly9naXRodWIuY29tL2dyYXBocWwtaGl2ZS9wbGF0Zm9ybSIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnNvdXJjZT0iaHR0cHM6Ly9naXRodWIuY29tL2dyYXBocWwtaGl2ZS9wbGF0Zm9ybSIKCkVOVFJZUE9JTlQgWyAiL2VudHJ5cG9pbnQuc2giIF0K",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 15
        },
        "end": {
          "line": 15
        }
      }
    ]
  },
  {
    "vertex": "sha256:3df27fd26c52e83275deea27f36b7726bd4ed697129430dd9ae040ab9817c8ab",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRJTUFHRV9ERVNDUklQVElPTicgKGxpbmUgMTcp",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "migrations.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSBjYS1jZXJ0aWZpY2F0ZXMKCldPUktESVIgL3Vzci9zcmMvYXBwCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpFTlYgRU5WSVJPTk1FTlQ9cHJvZHVjdGlvbgpFTlYgTk9ERV9FTlY9cHJvZHVjdGlvbgpFTlYgUkVMRUFTRT0kUkVMRUFTRQoKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmxpY2Vuc2VzPU1JVApMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudGl0bGU9JElNQUdFX1RJVExFCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS52ZXJzaW9uPSRSRUxFQVNFCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5kZXNjcmlwdGlvbj0kSU1BR0VfREVTQ1JJUFRJT04KTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmF1dGhvcnM9IlRoZSBHdWlsZCIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlbmRvcj0iS2FtaWwgS2lzaWVsYSIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybD0iaHR0cHM6Ly9naXRodWIuY29tL2dyYXBocWwtaGl2ZS9wbGF0Zm9ybSIKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnNvdXJjZT0iaHR0cHM6Ly9naXRodWIuY29tL2dyYXBocWwtaGl2ZS9wbGF0Zm9ybSIKCkVOVFJZUE9JTlQgWyAiL2VudHJ5cG9pbnQuc2giIF0K",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 17
        },
        "end": {
          "line": 17
        }
      }
    ]
  },
  {
    "vertex": "sha256:3618f71764d3a6cfff3331c54597ef642a21112323a6115f4377926ae814645e",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRJTUFHRV9USVRMRScgKGxpbmUgMTIp",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "services.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSB3Z2V0IGNhLWNlcnRpZmljYXRlcyAmJiBybSAtcmYgL3Zhci9saWIvYXB0L2xpc3RzLyoKCkFSRyBTRVJWSUNFX0RJUl9OQU1FCldPUktESVIgL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UubGljZW5zZXM9TUlUCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZT0kSU1BR0VfVElUTEUKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249JFJFTEVBU0UKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPSRJTUFHRV9ERVNDUklQVElPTgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYXV0aG9ycz0iVGhlIEd1aWxkIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPSJLYW1pbCBLaXNpZWxhIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgoKRU5WIEVOVklST05NRU5UPXByb2R1Y3Rpb24KRU5WIFJFTEVBU0U9JFJFTEVBU0UKRU5WIFBPUlQ9JFBPUlQKCkhFQUxUSENIRUNLIC0taW50ZXJ2YWw9NXMgXAogIC0tdGltZW91dD01cyBcCiAgLS1zdGFydC1wZXJpb2Q9NXMgXAogIC0tcmV0cmllcz02IFwKICBDTUQgJEhFQUxUSENIRUNLX0NNRAoKRU5UUllQT0lOVCBbICIvZW50cnlwb2ludC5zaCIgXQo=",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 12
        },
        "end": {
          "line": 12
        }
      }
    ]
  },
  {
    "vertex": "sha256:3618f71764d3a6cfff3331c54597ef642a21112323a6115f4377926ae814645e",
    "level": 1,
    "short": "VW5kZWZpbmVkVmFyOiBVc2FnZSBvZiB1bmRlZmluZWQgdmFyaWFibGUgJyRSRUxFQVNFJyAobGluZSAxMyk=",
    "detail": [
      "VmFyaWFibGVzIHNob3VsZCBiZSBkZWZpbmVkIGJlZm9yZSB0aGVpciB1c2U="
    ],
    "url": "https://docs.docker.com/go/dockerfile/rule/undefined-var/",
    "sourceInfo": {
      "filename": "services.dockerfile",
      "data": "RlJPTSBub2RlOjIyLjEzLjAtc2xpbQoKUlVOIGFwdC1nZXQgdXBkYXRlICYmIGFwdC1nZXQgaW5zdGFsbCAteSB3Z2V0IGNhLWNlcnRpZmljYXRlcyAmJiBybSAtcmYgL3Zhci9saWIvYXB0L2xpc3RzLyoKCkFSRyBTRVJWSUNFX0RJUl9OQU1FCldPUktESVIgL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FCgpDT1BZIC0tZnJvbT1kaXN0IC4gL3Vzci9zcmMvYXBwLyRTRVJWSUNFX0RJUl9OQU1FLwpDT1BZIC0tZnJvbT1zaGFyZWQgLiAvCgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UubGljZW5zZXM9TUlUCkxBQkVMIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZT0kSU1BR0VfVElUTEUKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249JFJFTEVBU0UKTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPSRJTUFHRV9ERVNDUklQVElPTgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYXV0aG9ycz0iVGhlIEd1aWxkIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPSJLYW1pbCBLaXNpZWxhIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgpMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlPSJodHRwczovL2dpdGh1Yi5jb20vZ3JhcGhxbC1oaXZlL3BsYXRmb3JtIgoKRU5WIEVOVklST05NRU5UPXByb2R1Y3Rpb24KRU5WIFJFTEVBU0U9JFJFTEVBU0UKRU5WIFBPUlQ9JFBPUlQKCkhFQUxUSENIRUNLIC0taW50ZXJ2YWw9NXMgXAogIC0tdGltZW91dD01cyBcCiAgLS1zdGFydC1wZXJpb2Q9NXMgXAogIC0tcmV0cmllcz02IFwKICBDTUQgJEhFQUxUSENIRUNLX0NNRAoKRU5UUllQT0lOVCBbICIvZW50cnlwb2ludC5zaCIgXQo=",
      "language": "Dockerfile"
    },
    "range": [
      {
        "start": {
          "line": 13
        },
        "end": {
          "line": 13
        }
      }
    ]
  }
],
"commerce": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The commerce service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/commerce",
          "build-arg:PORT": "3010",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/commerce",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/wqwd5sj21tio5ovqqvy61cl7n",
  "containerimage.config.digest": "sha256:d4337ec23e261e9442331a966aee3fecf73803646b8fed70594b7d0dab621cec",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:2b20870269033f45155ad9e1cf857abd540e6641dbb9432af0d830fe4531ea1d",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:2b20870269033f45155ad9e1cf857abd540e6641dbb9432af0d830fe4531ea1d",
  "image.name": "ghcr.io/graphql-hive/commerce:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/commerce:kamil_router_docs_auth-amd64"
},
"composition-federation-2": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "Federation 2 Composition Service for GraphQL Hive.",
          "build-arg:IMAGE_TITLE": "graphql-hive/composition-federation-2",
          "build-arg:PORT": "3069",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/external-composition",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/z3ty7p4za9mf75c0uklbwa9ka",
  "containerimage.config.digest": "sha256:af55e180943ca6939163039832012ee4f0c5527d2e16fb7954ff2f6b6ac847fa",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:670287e480febe673010757528afbb71d1ad7fad96a3cd7205ba72482df923b6",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:670287e480febe673010757528afbb71d1ad7fad96a3cd7205ba72482df923b6",
  "image.name": "ghcr.io/graphql-hive/composition-federation-2:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/composition-federation-2:kamil_router_docs_auth-amd64"
},
"emails": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The emails service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/emails",
          "build-arg:PORT": "3006",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/emails",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/vev22en29syqeolroaopw5x5h",
  "containerimage.config.digest": "sha256:64e38224b52282b77d98402cf3da20d4d6871c727f5af7ed317d93cffb2c9d25",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:73cb8a469667282732563904047f8da4b77e951bcfc777afddd9926fff4375ca",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:73cb8a469667282732563904047f8da4b77e951bcfc777afddd9926fff4375ca",
  "image.name": "ghcr.io/graphql-hive/emails:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/emails:kamil_router_docs_auth-amd64"
},
"otel-collector": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/alpine@3.14?platform=linux%2Famd64",
        "digest": {
          "sha256": "0f2d5c38dd7a4f4f733e688e3a6733cb5ab1ac6e3cb4603a5dd564e5bfb80eed"
        }
      },
      {
        "uri": "pkg:docker/golang@1.25-bookworm?platform=linux%2Famd64",
        "digest": {
          "sha256": "e17419604b6d1f9bc245694425f0ec9b1b53685c80850900a376fb10cb0f70cb"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "otel-collector.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:IMAGE_DESCRIPTION": "OTEL Collector for GraphQL Hive.",
          "build-arg:IMAGE_TITLE": "graphql-hive/otel-collector",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dockerfile"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/mjf8a05qlw3xzggmj3dma7az7",
  "containerimage.config.digest": "sha256:cb37d978eb46ff81d456a708a2b2e208de7bde3e7c8b2460274f443d07e465c2",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:d3b1435d9c4690526c3855ebb64df123c78afcbe8716946d69bc879f37cf9ff9",
    "size": 1089,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:d3b1435d9c4690526c3855ebb64df123c78afcbe8716946d69bc879f37cf9ff9",
  "image.name": "ghcr.io/graphql-hive/otel-collector:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/otel-collector:kamil_router_docs_auth-amd64"
},
"policy": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The policy service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/policy",
          "build-arg:PORT": "3012",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/policy",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/yqyub7bhstonk4yt2llu4v0x1",
  "containerimage.config.digest": "sha256:deae03ece6e50a992484f965b6fd28cb05af85cd5ea689442ff8b62d38eccccb",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:ba05aeb79a0409043778342b07329fec49249e8e11cb96cddd0dcb1205146af6",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:ba05aeb79a0409043778342b07329fec49249e8e11cb96cddd0dcb1205146af6",
  "image.name": "ghcr.io/graphql-hive/policy:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/policy:kamil_router_docs_auth-amd64"
},
"schema": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The schema service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/schema",
          "build-arg:PORT": "3002",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/schema",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/l31z70r2v4ec5pq0wvapi3ppd",
  "containerimage.config.digest": "sha256:c093cabdb93e3931d7cae8ebf9b7d192d4a635be28be2a959133487975d07ae4",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:8633483c7bcbe103c7e0b0c0cb5ab5e249d90d65163ceedec0be02d7ac37e62c",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:8633483c7bcbe103c7e0b0c0cb5ab5e249d90d65163ceedec0be02d7ac37e62c",
  "image.name": "ghcr.io/graphql-hive/schema:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/schema:kamil_router_docs_auth-amd64"
},
"server": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The server service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/server",
          "build-arg:PORT": "3001",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/server",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/5m496f2rtm7bar2vycvpudf7s",
  "containerimage.config.digest": "sha256:00d0adb9d48d78865af006e35b4a8ad2226c0c355d91e4084331d52398ed25c1",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:143535addd8b39e3fa0704d6788dff884e6cc8aaa9473f19f38e006bb31a3776",
    "size": 2076,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:143535addd8b39e3fa0704d6788dff884e6cc8aaa9473f19f38e006bb31a3776",
  "image.name": "ghcr.io/graphql-hive/server:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/server:kamil_router_docs_auth-amd64"
},
"storage": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "migrations.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:IMAGE_DESCRIPTION": "The migrations service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/storage",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/iz4xus2lvwldwkrmc7r1mkmt4",
  "containerimage.config.digest": "sha256:378f16a64eb1b338d69de8e0a824b61d3c339f2c91cf19926a358b087570ea84",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:70173a0bcc796cffd412205c7c84d9dbfa02aaada40a39d4f81ef673026f32a6",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:70173a0bcc796cffd412205c7c84d9dbfa02aaada40a39d4f81ef673026f32a6",
  "image.name": "ghcr.io/graphql-hive/storage:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/storage:kamil_router_docs_auth-amd64"
},
"tokens": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The tokens service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/tokens",
          "build-arg:PORT": "3003",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/tokens",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/uw25bzfoyr5znig6warx6lqja",
  "containerimage.config.digest": "sha256:b2069aaf51b040d89d22893bcdb8fc92d7169ef424bc99976e1e5ead8364f18c",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:229636f395fb6c656dd85225678f604f3a629ceb0d4a6ee6a7256f8e1b15c685",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:229636f395fb6c656dd85225678f604f3a629ceb0d4a6ee6a7256f8e1b15c685",
  "image.name": "ghcr.io/graphql-hive/tokens:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/tokens:kamil_router_docs_auth-amd64"
},
"usage": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The usage ingestor service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/usage",
          "build-arg:PORT": "3006",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/usage",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/csuj5b4yg0fi0tso6vqhtvf70",
  "containerimage.config.digest": "sha256:05911840425c6b8d61e6a3d38fca40de8ca625a44c526e6b91c2284a39e97a15",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:a616809770ccb547603521505143f7e21de27e8ce1afbeacab5247c8fef9cf18",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:a616809770ccb547603521505143f7e21de27e8ce1afbeacab5247c8fef9cf18",
  "image.name": "ghcr.io/graphql-hive/usage:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/usage:kamil_router_docs_auth-amd64"
},
"usage-ingestor": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The usage ingestor service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/usage-ingestor",
          "build-arg:PORT": "3007",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/usage-ingestor",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/nexu5jzpv27oxo9x7vwojjz8z",
  "containerimage.config.digest": "sha256:15fd448739b32aea243f8657a27758bebfe9efaaaba7f0e8556b4449238b65ec",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:737de2832ac209fd847d7f0d0a4fb5dac09e62b2faa6e023d45e41f85d6fbb5a",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:737de2832ac209fd847d7f0d0a4fb5dac09e62b2faa6e023d45e41f85d6fbb5a",
  "image.name": "ghcr.io/graphql-hive/usage-ingestor:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/usage-ingestor:kamil_router_docs_auth-amd64"
},
"webhooks": {
  "buildx.build.provenance": {
    "builder": {
      "id": ""
    },
    "buildType": "https://mobyproject.org/buildkit@v1",
    "materials": [
      {
        "uri": "pkg:docker/node@22.13.0-slim?platform=linux%2Famd64",
        "digest": {
          "sha256": "f5a0871ab03b035c58bdb3007c3d177b001c2145c18e81817b71624dcf7d8bff"
        }
      }
    ],
    "invocation": {
      "configSource": {
        "entryPoint": "services.dockerfile"
      },
      "parameters": {
        "frontend": "dockerfile.v0",
        "args": {
          "build-arg:HEALTHCHECK_CMD": "wget --spider -q http://127.0.0.1:${PORT}/_readiness",
          "build-arg:IMAGE_DESCRIPTION": "The webhooks ingestor service of the GraphQL Hive project.",
          "build-arg:IMAGE_TITLE": "graphql-hive/webhooks",
          "build-arg:PORT": "3005",
          "build-arg:RELEASE": "5c34e961a70147b83210030edbcfd63a64459e8a",
          "build-arg:SERVICE_DIR_NAME": "@hive/webhooks",
          "context:dist": "local:dist",
          "context:shared": "local:shared",
          "frontend.caps": "moby.buildkit.frontend.contexts+forward",
          "local-sessionid:context": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:dockerfile": "qh68kzv8fg1jcegzj9eug2yvx",
          "local-sessionid:shared": "qh68kzv8fg1jcegzj9eug2yvx"
        },
        "locals": [
          {
            "name": "context"
          },
          {
            "name": "dist"
          },
          {
            "name": "dockerfile"
          },
          {
            "name": "shared"
          }
        ]
      },
      "environment": {
        "platform": "linux/amd64",
        "ProvenanceCustomEnv": null
      }
    }
  },
  "buildx.build.ref": "builder-63bc29c7-72f6-46c7-a952-2a6458982c41/builder-63bc29c7-72f6-46c7-a952-2a6458982c410/zmkgp1146jhzpyvc9ihan0c4o",
  "containerimage.config.digest": "sha256:824aaba6752ec525a330adfec222b7c179290ae86601a85e9618c314c3851e30",
  "containerimage.descriptor": {
    "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
    "digest": "sha256:b77b55b371d95742796c89ebd82bff4bc528ac02ffe6bae614617be4a6af1845",
    "size": 2075,
    "platform": {
      "architecture": "amd64",
      "os": "linux"
    }
  },
  "containerimage.digest": "sha256:b77b55b371d95742796c89ebd82bff4bc528ac02ffe6bae614617be4a6af1845",
  "image.name": "ghcr.io/graphql-hive/webhooks:5c34e961a70147b83210030edbcfd63a64459e8a-amd64,ghcr.io/graphql-hive/webhooks:kamil_router_docs_auth-amd64"
}
}

@kamilkisiela kamilkisiela force-pushed the kamil-router-docs-auth branch from 29b6222 to bba7f06 Compare November 24, 2025 12:16
@kamilkisiela kamilkisiela marked this pull request as ready for review November 25, 2025 08:27
@kamilkisiela kamilkisiela removed the waiting-on:router-release Do not merge: waiting for Router release that includes this feature. label Nov 25, 2025
@kamilkisiela kamilkisiela changed the title Add authorization documentation and specification docs(router): Add authorization documentation and specification Nov 25, 2025
@kamilkisiela kamilkisiela force-pushed the kamil-router-docs-auth branch from bba7f06 to 4952391 Compare November 25, 2025 08:52
jdolle
jdolle reviewed Nov 25, 2025
View reviewed changes
packages/web/docs/src/content/router/configuration/authorization.mdx
authentication status or specific scopes.

For practical examples and a guide to authorization concepts, see
**["Authorization"](../security/authorization)** in the documentation.
Copy link
Collaborator

@jdolle jdolle Nov 25, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like that authorization is covered both in the configuration and security section, but this page is technically "authorization in the documentation" also.

I think it would be good to make a more clear delineation between the two documents. E.g. security/authorization could talk about more broadly about authorization and high-level motives behind our approach, and configuration/authorization can provide the details about configuration options in the router and cover the specific directive definitions.

This is true for most of the content in Security subpages. We could move important details to their related configuration page, and make Security a more high-level page that acts as an introduction to these features as concepts rather than provide too much detail up front.

Copy link
Contributor Author

@kamilkisiela kamilkisiela Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want to avoid writing high-level content and link people to different pages. The idea here is to give people a comprehensive guide on authorization and only branch out to other pages when it involves a bigger/standalone topic (like JWT - as it's not only about authorization, but authentication too).

The only thing that is configuration-specific is filter/reject mode. I forgot to remove the directives from this page.

The configuration pages will be generated from code once Dotan is back and I'm fine with duplicating content a bit.

jdolle
jdolle reviewed Nov 25, 2025
View reviewed changes
packages/web/docs/src/content/router/configuration/authorization.mdx Outdated
# User must have either scope
admin: AdminPanel @requiresScopes(scopes: [["admin:users"], ["admin:system"]])

# User must have read:users AND (admin:users OR admin:system)
Copy link
Collaborator

@jdolle jdolle Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

great example and explanations. This is what 99% of people will want to know.

jdolle
jdolle reviewed Nov 25, 2025
View reviewed changes
packages/web/docs/src/content/router/configuration/authorization.mdx
### Filter Mode (Default)

With `filter` mode, unauthorized fields are silently removed from the operation, but the query
continues to execute and return the data the user can access:
Copy link
Collaborator

@jdolle jdolle Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why might one choose reject over filter? And should we mention how nullability impacts this? A lot of developers who are new to graphql don't realize how error bubbling works.

Copy link
Contributor Author

@kamilkisiela kamilkisiela Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A separate section about nullability yes, good idea, but imo explaining when to use each mode is kind of obvious to people (they know their behaviour and there's nothing more to add really)

jdolle
jdolle reviewed Nov 25, 2025
View reviewed changes
packages/web/docs/src/content/router/security/authorization.mdx
To access `User.username`, a client must have **both** `user:read` and `profile:read` scopes,
ensuring they meet the access requirements from all subgraphs where the field is defined.

### Merging `@requiresScopes`
Copy link
Collaborator

@jdolle jdolle Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is mostly redundant with the field-level composition. Could these be simplified to a single section about merging across subgraphs?

Copy link
Contributor Author

@kamilkisiela kamilkisiela Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section explains how scopes are merged. Nowhere in the field-level composition I cover that. It's part of higher "Combining Directives Across Federated Types" section.

jdolle
jdolle reviewed Nov 25, 2025
View reviewed changes
packages/web/docs/src/content/router/security/authorization.mdx
}
```

Enable reject mode by setting `unauthorized.mode: reject` in your router configuration:
Copy link
Collaborator

@jdolle jdolle Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as mentioned previously, it may be worth calling out issues with nullability and why you might choose one approach over the other

Copy link
Contributor Author

@kamilkisiela kamilkisiela Nov 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure it's worth explaining why pick one over another. It's obvious what they do and I feel like people will know when to use them, there are no rules when to use filter over reject, except one "If you want to reject request when at least one field is unauthorized you 'reject'", which is what I wrote:

If a user tries to access any unauthorized field, the entire request is rejected and no data is
returned.

@kamilkisiela kamilkisiela merged commit b3ab94b into main Nov 28, 2025
24 of 25 checks passed
@kamilkisiela kamilkisiela deleted the kamil-router-docs-auth branch November 28, 2025 09:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jdolle jdolle jdolle left review comments

@n1ru4l n1ru4l n1ru4l approved these changes

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kamilkisiela @jdolle @n1ru4l