How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?

Q: How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?

@ObjectType() export class User { @Field(() => Int) id: number; @Field() email: string; @Field() name: string; @Field({ nullable: true }) salary?: number; // sensitive field @Field({ nullable: true }) ssn?: string; // sensitive field } @Resolver(() => User) export class UsersResolver { constructor(private abilityFactory: AbilityFactory) {} // salary — role-based check @ResolveField(() => Number, { nullable: true }) salary(@Parent() user: User, @Context() ctx: GqlContext): number | null { if (!ctx.req.user?.roles.includes('admin')) return null; return user.salary ?? null; } // ssn — ABAC with CASL field-level check @ResolveField(() => String, { nullable: true }) ssn(@Parent() user: User, @Context() ctx: GqlContext): string | null { const ability = this.abilityFactory.createForUser(ctx.req.user); if (ability.cannot('read', subject('User', user), 'ssn')) return null; return user.ssn ?? null; } } Return null for unauthorized fields — never throw an error; GraphQL partial results are expected. Declare the field as nullable: true in the schema so the null return is valid. @ResolveField() is lazy — it only runs when the client explicitly requests that field. Use GqlExecutionContext.create(context) in guards if applying field-level guards instead of resolver logic. CASL ability.cannot('read', subject, 'fieldName') checks the third argument as a field condition.

Difficulty: 6/10

field-level authorization, NestJS guards, GraphQL resolvers

Add a @ResolveField() for sensitive fields and check the requesting user's permissions inside the resolver. Return null when the user lacks permission. For ABAC-based field authorization, use CASL's ability.cannot() on the field name. This ensures sensitive data is never included in the response for unauthorized users.

Field-level authorization in GraphQL resolvers

Field-level authorization design notes:

1
Return null for unauthorized fields — never throw an error; GraphQL partial results are expected.
2
Declare the field as nullable: true in the schema so the null return is valid.
3
@ResolveField() is lazy — it only runs when the client explicitly requests that field.
4
Use GqlExecutionContext.create(context) in guards if applying field-level guards instead of resolver logic.
5
CASL ability.cannot('read', subject, 'fieldName') checks the third argument as a field condition.

Scenario Questions

0-2 years experience

2-5 years experience

1You need to add field‑level permission checks to several resolvers, but the same logic repeats. How would you refactor to avoid duplication, and what trade‑offs does your approach have?

How do you implement permission-based authorization at the field level in a GraphQL resolver in NestJS?

Scenario Questions

Follow-up Questions