PHPackages                             nextagencyio/graphql\_oauth\_fix - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. nextagencyio/graphql\_oauth\_fix

ActiveDrupal-module[Authentication & Authorization](/categories/authentication)

nextagencyio/graphql\_oauth\_fix
================================

Fixes OAuth integration with GraphQL in Drupal 11 by providing OAuth-aware access checks for GraphQL requests.

1.0(1y ago)03GPL-2.0-or-laterPHPPHP >=8.1

Since Jun 23Pushed 1y agoCompare

[ Source](https://github.com/nextagencyio/graphql_oauth_fix)[ Packagist](https://packagist.org/packages/nextagencyio/graphql_oauth_fix)[ Docs](https://github.com/nextagencyio/graphql_oauth_fix)[ RSS](/packages/nextagencyio-graphql-oauth-fix/feed)WikiDiscussions 1.x Synced today

READMEChangelogDependencies (4)Versions (2)Used By (0)

GraphQL OAuth Fix Module
========================

[](#graphql-oauth-fix-module)

Overview
--------

[](#overview)

This custom module fixes OAuth integration with GraphQL in Drupal 11 by providing OAuth-aware access checks for GraphQL requests. It addresses the integration issue between Simple OAuth 6.0 and GraphQL where OAuth bearer token authentication doesn't properly establish user context for GraphQL access checks.

Problem Description
-------------------

[](#problem-description)

In Drupal 11 with Simple OAuth 6.0 and GraphQL Compose, OAuth bearer token authentication works correctly (tokens are generated and validated), but the GraphQL access check system doesn't recognize the authenticated user context. This results in OAuth-authenticated requests being treated as anonymous requests, causing "permission required" errors even when valid bearer tokens are provided.

Solution
--------

[](#solution)

This module provides:

1. **OAuthAuthenticationSubscriber**: An event subscriber that detects GraphQL requests with OAuth bearer tokens and stores the authenticated user context in request attributes.
2. **OAuthAwareQueryAccessCheck**: A custom access check service that overrides the default GraphQL query access check to properly handle OAuth-authenticated users by:

    - Checking the current user service for authenticated users
    - Looking for OAuth authentication flags in request attributes
    - Using the OAuth-authenticated account for permission checks

Technical Details
-----------------

[](#technical-details)

### Event Subscriber

[](#event-subscriber)

- Runs on `KernelEvents::REQUEST` with priority 10
- Detects GraphQL requests by checking path patterns and request attributes
- Stores OAuth authentication context in request attributes

### Access Check Override

[](#access-check-override)

- Replaces `access_check.graphql.query` service via `graphql_oauth_fix.services.yml`
- Implements the same permission logic as the original GraphQL access check
- Adds OAuth-awareness by checking multiple sources for authenticated user context

Configuration
-------------

[](#configuration)

No additional configuration is required. The module automatically:

- Detects GraphQL requests
- Processes OAuth bearer tokens
- Applies proper permission checks

Status
------

[](#status)

✅ **Implemented**: OAuth-aware GraphQL access checks ✅ **Working**: GraphQL permission system recognizes OAuth authentication ⚠️ **Pending**: Simple OAuth 6.0 scope configuration requires additional setup

### Known Issue: Simple OAuth 6.0 Scope Requirements

[](#known-issue-simple-oauth-60-scope-requirements)

Simple OAuth 6.0 requires scope parameters even when scopes are disabled in configuration. This is a separate OAuth server configuration issue, not related to the GraphQL integration fix provided by this module.

**Workaround**: Configure appropriate OAuth scopes or use alternative OAuth flow.

Usage
-----

[](#usage)

Once enabled, OAuth-authenticated GraphQL requests will work correctly:

```
# Generate OAuth token
curl -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=basic" \
  http://your-site.com/oauth/token

# Use token for GraphQL requests
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -d '{"query":"{ route(path: \"/\") { ... on NodeLanding { title } } }"}' \
  http://your-site.com/graphql
```

Dependencies
------------

[](#dependencies)

- `graphql:graphql`
- `simple_oauth:simple_oauth`

Author
------

[](#author)

Created for DrupalX project to resolve OAuth + GraphQL integration issues in Drupal 11.

###  Health Score

28

—

LowBetter than 52% of packages

Maintenance49

Moderate activity, may be stable

Popularity3

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity45

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

375d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/23e37b1ecb5973dbb1a3b1be781229da7602aee47963477ba49fcc353e3e04eb?d=identicon)[drupalninja](/maintainers/drupalninja)

---

Top Contributors

[![nextagencyio](https://avatars.githubusercontent.com/u/1112449?v=4)](https://github.com/nextagencyio "nextagencyio (1 commits)")

---

Tags

graphqlAuthenticationdrupaloauthdrupal-11simple-oauth

### Embed Badge

![Health badge](/badges/nextagencyio-graphql-oauth-fix/health.svg)

```
[![Health](https://phpackages.com/badges/nextagencyio-graphql-oauth-fix/health.svg)](https://phpackages.com/packages/nextagencyio-graphql-oauth-fix)
```

###  Alternatives

[league/oauth2-server

A lightweight and powerful OAuth 2.0 authorization and resource server library with support for all the core specification grants. This library will allow you to secure your API with OAuth and allow your applications users to approve apps that want to access their data from your API.

6.7k147.0M288](/packages/league-oauth2-server)[league/oauth2-client

OAuth 2.0 Client Library

3.8k128.7M1.3k](/packages/league-oauth2-client)[hwi/oauth-bundle

Support for authenticating users using both OAuth1.0a and OAuth2 in Symfony.

2.4k22.3M81](/packages/hwi-oauth-bundle)[league/oauth1-client

OAuth 1.0 Client Library

996110.3M120](/packages/league-oauth1-client)[hybridauth/hybridauth

PHP Social Authentication Library

3.4k9.0M108](/packages/hybridauth-hybridauth)[lusitanian/oauth

PHP 7.2 oAuth 1/2 Library

1.1k24.0M133](/packages/lusitanian-oauth)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)