field_acl.ex

defmodule XXX.Schema.Middleware.FieldACL do
  @behaviour Absinthe.Middleware

  def call(resolution, {_field, nil}) do
    resolution
  end

  def call(resolution, {field, public_fields}) do
    logged_in? = Map.get(resolution.context, :current_user) != nil

    if logged_in? or public_field?(field, public_fields) do
      resolution
    else
      external_field_name =
        field
        |> to_string()
        |> Hive.API.Schema.Adapter.to_external_name(:field)

      Absinthe.Resolution.put_result(
        resolution,
        {:error, "unauthorized: field #{external_field_name} is private"}
      )
    end
  end

  def public_field?(_field, :all), do: true

  def public_field?(_field, :none), do: false

  def public_field?(field, {:except, private_fields}) when is_list(private_fields),
    do: public_field?(field, {:except, MapSet.new(private_fields)})

  def public_field?(field, public_fields) when is_list(public_fields),
    do: public_field?(field, MapSet.new(public_fields))

  def public_field?(field, {:except, %MapSet{} = private_fields}),
    do: not MapSet.member?(private_fields, field)

  def public_field?(field, %MapSet{} = public_fields), do: MapSet.member?(public_fields, field)
end