auth.js

import { context } from '@redwoodjs/api/dist/globalContext'
import { AuthenticationError } from '@redwoodjs/api'

import { db } from 'src/lib/db'

const cookie = require('cookie')

export const userContext = async ({ event, _context }) => {
  const cookie = cookie.parse(event.headers.cookie || '')
  console.log(cookie)
  if (!cookie) {
    return {}
  }
  const data //[redacted] read session data from cookie
  const currentPerson = await db.person.findOne({
    where: { id: Number(data.person_id) },
  })
  return { currentPerson }
}

export const requireAuth = () => {
  console.log(context)
  if (!context.currentPerson) {
    throw new AuthenticationError("You don't have permission to do that.")
  }
  return context.currentUser
}

graphql.js

import { userContext } from 'src/lib/auth'
const schemas = importAll('api', 'graphql')
const services = importAll('api', 'services')

export const handler = createGraphQLHandler({
  context: userContext,
  schema: makeMergedSchema({
    schemas,
    services: makeServices({ services }),
  }),
  db,
})