README

Overview

This custom module fixes OAuth integration with GraphQL in Drupal 11 by providing OAuth-aware access checks for GraphQL requests. It addresses the integration issue between Simple OAuth 6.0 and GraphQL where OAuth bearer token authentication doesn't properly establish user context for GraphQL access checks.

Problem Description

In Drupal 11 with Simple OAuth 6.0 and GraphQL Compose, OAuth bearer token authentication works correctly (tokens are generated and validated), but the GraphQL access check system doesn't recognize the authenticated user context. This results in OAuth-authenticated requests being treated as anonymous requests, causing "permission required" errors even when valid bearer tokens are provided.

Solution

This module provides:

1. OAuthAuthenticationSubscriber: An event subscriber that detects GraphQL requests with OAuth bearer tokens and stores the authenticated user context in request attributes.

2. OAuthAwareQueryAccessCheck: A custom access check service that overrides the default GraphQL query access check to properly handle OAuth-authenticated users by:

   • Checking the current user service for authenticated users
   • Looking for OAuth authentication flags in request attributes
   • Using the OAuth-authenticated account for permission checks

Technical Details

Event Subscriber

• Runs on KernelEvents::REQUEST with priority 10
• Detects GraphQL requests by checking path patterns and request attributes
• Stores OAuth authentication context in request attributes

Access Check Override

• Replaces access_check.graphql.query service via graphql_oauth_fix.services.yml
• Implements the same permission logic as the original GraphQL access check
• Adds OAuth-awareness by checking multiple sources for authenticated user context

Configuration

No additional configuration is required. The module automatically:

• Detects GraphQL requests
• Processes OAuth bearer tokens
• Applies proper permission checks

Status

✅ Implemented: OAuth-aware GraphQL access checks ✅ Working: GraphQL permission system recognizes OAuth authentication ⚠️ Pending: Simple OAuth 6.0 scope configuration requires additional setup

Known Issue: Simple OAuth 6.0 Scope Requirements

Simple OAuth 6.0 requires scope parameters even when scopes are disabled in configuration. This is a separate OAuth server configuration issue, not related to the GraphQL integration fix provided by this module.

Workaround: Configure appropriate OAuth scopes or use alternative OAuth flow.

Usage

Once enabled, OAuth-authenticated GraphQL requests will work correctly:

# Generate OAuth token
curl -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=basic" \
  http://your-site.com/oauth/token

# Use token for GraphQL requests
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{"query":"{ route(path: \"/\") { ... on NodeLanding { title } } }"}' \
  http://your-site.com/graphql

Dependencies

• graphql:graphql
• simple_oauth:simple_oauth

Author

Created for DrupalX project to resolve OAuth + GraphQL integration issues in Drupal 11.