After investing nearly $2 billion of its Innovation Fund in Latin America in 2019, Softbank announced this month that it would add an additional $1 billion into the fund to continue supporting tech startups across the region. While the Japanese investor faces the challenge of raising a second global fund after its Vision Fund, Softbank is still investing heavily in Latin America.
One of its early Latin American investments – and the first in Colombia – Ayenda Rooms, is performing particularly well, raising $8.7 million from Kaszek Ventures this month. Ayenda is the local version of Oyo Rooms, one of Softbank’s biggest bets in India, which has looked to expand into Mexico despite a financial crunch last month. In fact, the fund recently came under scrutiny by the Wall Street Journal for funding similar delivery competitors Uber, Rappi, and Didi, suggesting a conflict of interest.
Most recently, Softbank invested $125 million in Mexico’s lender, Alphacredit, and they reportedly plan to continue investing in that niche. The firm currently oversees over 650 companies in Latin America, largely concentrated in Brazil, Argentina, Chile, Colombia, and Mexico, and plans to invest $100-150M in seventeen firms and two VCs by the end of the year. To date, over 50% of Softbank’s investments have been into Brazil, most of which exist in the fintech sector.
In a self-fulfilling prophecy, Mexico’s neobank market became all the more competitive this month with the addition of a new player: Stori. Within the past few months, both TechCrunch and Business Insider pointed to Mexico’s neobank market as the one to watch in Latin America as startups like Albo, Klar, and Nubank battle for market share. In February, digital bank Stori joined the conversation with a $10 million Series A from Bertelsmann Investments (BI) and Source Code Capital, along with an existing investor, Vision Plus Capital.
This round of funding, led by Chinese investors, is part of a growing trend of foreign funds waking up to the Latin American startup ecosystem, Asian VCs in particular. Tencent has invested in Brazil’s Nubank, which has since expanded to Mexico, and in Argentina’s Uala, which is considering a similar move. Softbank has investments in the largest lending and credit startups in Brazil and Mexico, as well.
Stori will use the investment to improve its AI technology as it tries to reach over 100,000 Mexicans through its inclusive digital banking services. The neobank has raised over $17 million from investors since it was founded in 2018.
In January, Rappi and Lime pulled back their operations in Latin America in order to focus on technology over rapid growth. Brazil’s top mobility startup, Grow Mobility (which rose out of a merger between e-scooter companies Grin from Mexico and Yellow from Brazil) also pulled back. The startup, which provides e-scooters and bikes shares across Brazil, took bicycles out of operation and removed its scooters from 14 cities.
Grow also restructured its operations through layoffs that affected employees across Brazil, although they did not comment on how many people were affected. Grow Mobility’s scooters will now only operate in Rio de Janeiro, Sao Paulo, and Curitiba.
This pattern of pull-back following explosive growth has become more common among Latin America’s biggest startups, pushing these early stage companies to focus on technological solutions that boost revenue, rather than blitzscaling measures that only buy market share.
Amazon Web Services (AWS) announced it would invest $236 million (R$1 billion) into Sao Paulo over the next two years to strengthen its Latin American infrastructure. This effort may be a part of Amazon’s work to consolidate market share in Latin America’s increasingly competitive e-commerce market, where legacy players like MercadoLibre still dominate. This investment will enable Amazon to expand its Brazilian data centers and improve local service offerings to both private and public partners.
Amazon also announced that it would build a new distribution center in Pernambuco in the north of Brazil to support sales across the country. Brazil accounts for almost 40% of Latin America’s e-commerce market, making the country vital to Amazon’s positioning in the region.
Weel, a Brazilian accounts-receivable management platform, announced an $18.4 million investment from Banco Votorantim, Brazil’s seventh-largest bank, in February 2020. This investment was Banco Votorantim’s second in the startup after a $6 million contribution in 2019. Weel will use the investment to explore expansion across Brazil, as well as exploring Chilean and Mexican markets.
Chilean international transfer startup Global 66 received $3.25 million in February from UK investor Venrex, to continue its expansion across the region. The startup currently offers rates up to eight times better than existing transfer services, especially for the Latin American region. Global 66 recently opened new offices in Peru and plans to expand to Colombia, Argentina, and Mexico within the next two years. Within just two years of operations, Global 66 has processed transactions for over 25,000 users across 60 cities worldwide.
Yuca, a Brazilian proptech, raised $4.7 million from Monashees, ONEVC, and Creditas to help fight housing crises in Brazil’s largest cities. As Brazil’s cities sprawl – Sao Paulo is one of the largest in the world – Yuca creates central co-living spaces for young people that want to shorten their commutes. Inspired by Chinese startup, Ziroom, Yuca currently manages 18 apartments for 80 students and plans to scale to 500 apartments by the end of the year.
Brazil’s digital prescription startup, Memed, recently raised $4.5 million from DNA Capital and Redpoint eVentures to improve the local prescription system for doctors and patients alike. Today, Memed has over 80,000 registered doctors who have created over 10 million prescriptions worth more than $237 million. Memed’s 100% digital prescriptions are said to improve security and efficiency in Brazil’s complex, bureaucratic healthcare system.
While Brazil is still at the forefront of Latin America’s tech ecosystem, Mexican fintechs are edging up, especially with additional support from international investors. 2020 is off to a strong start, hinting at another potential record-breaking year for Latin American tech investment.
Here’s a great thread by Kevin Powell that's making the rounds. He believes so many folks see CSS as a frustrating and annoying language:
Why do people respect JavaScript or other languages enough to learn them inside-out, and yet constantly dunk on CSS? Well, all this reminds me of what Jeremy Keith wrote a while back when he argued that CSS is simple, but not easy:
Unlike a programming language that requires knowledge of loops, variables, and other concepts, CSS is pretty easy to pick up. Maybe it’s because of this that it has gained the reputation of being simple. It is simple in the sense of “not complex”, but that doesn’t mean it’s easy. Mistaking “simple” for “easy” will only lead to heartache.
I think that’s what’s happened with some programmers coming to CSS for the first time. They’ve heard it’s simple, so they assume it’s easy. But then when they try to use it, it doesn’t work. It must be the fault of the language, because they know that they are smart, and this is supposed to be easy. So they blame the language. They say it’s broken. And so they try to “fix” it by making it conform to a more programmatic way of thinking.
There have been time where I’ve sat down with engineers to pair with them about a tricky layout issue and the CSS is treated as being beneath them — as if the language is somehow too unpredictable to warrant learning and mastering. Perhaps this has something to do with the past, where we’ve spent years fighting the way browsers render things differently. But this is mostly a solved problem. I can’t remember the last time I fought against browsers like that.
Instead, I reckon the biggest issue that engineers face — and the reason why they find it all so dang frustrating — is that CSS forces you to face the webishness of the web. Things require fallbacks. You need to take different devices into consideration, and all the different ways of seeing a website: mobile, desktop, no mouse, no keyboard, etc. Sure, you have to deal with that when writing JavaScript, too, but it’s easier to ignore. You can’t ignore your the layout of your site being completely broken on a phone.
Side note: We have a guide to centering in CSS not because CSS is busted and dumb, but because there’s so many variables to the extent that a simple question like, “How do I center text?” is actually much more complicated than it appears. There’s so much context that’s missed.
This reminds me of one of my favorite blog posts of all time, where Brandon Smith argues that CSS is awesome and we should respect the language and learn how it works under the hood:
CSS is hard because its properties interact, often in unexpected ways. Because when you set one of them, you're never just setting that one thing. That one thing combines and bounces off of and contradicts with a dozen other things, including default things that you never actually set yourself.
One rule of thumb for mitigating this is, never be more explicit than you need to be. Web pages are responsive by default. Writing good CSS means leveraging that fact instead of overriding it. Use percentages or viewport units instead of a media query if possible. Use
min-widthinstead ofwidthwhere you can. Think in terms of rules, in terms of what you really mean to say, instead of just adding properties until things look right. Try to get a feel for how the browser resolves layout and sizing, and make your changes and additions on top of that judiciously. Work with CSS, instead of against it.
The post Why is CSS Frustrating? appeared first on CSS-Tricks.
One particular pattern [for loading non-critical CSS] I’ve seen is the preload/polyfill pattern. With this approach, you load any stylesheets as preloads instead, and then use their
onloadevents to change them back to a stylesheet once the browser has them ready.
So you're trying to make your stylesheet more async, but it causes two big problems:
Firefox does something fancy to avoid problem #2 in this particular case, but it affects every other browser.
I've never had good luck with fancy techniques to trick the browser into theoretically better downloading/rendering patterns. I'm kind of a stylesheets in the head, scripts at the end of the body kinda guy, but I know the web is a complicated place. In fact, in a quick peek, I see that Jetpack is inserting an inline script into my <head>, so that would affect my loading too, except they load it with an obfuscated type until later scripts execute and change it, probably to avoid this exact problem.
Anyway, Tim's advice:
• If you’re using loadCSS with the preload/polyfill pattern, switch to the
• If you have any external stylesheets that you’re loading normally (that is, as a regular stylesheet link), move any and all inline scripts that you can above it in the markup
• Inline your critical CSS for the fastest possible start render times.
The print pattern being:
<link rel="stylesheet" href="/path/to/my.css" media="print" onload="this.media='all'">Direct Link to Article — Permalink
The post When CSS Blocks appeared first on CSS-Tricks.
Amazon Transcribe, the AWS-based speech-to-text service, launched a small but important new feature this morning that, if implemented correctly, can automatically hide your personally identifiable information from call transcripts.
One of the most popular use cases for Transcribe is to create a record of customer calls. Almost by default, that involves exchanging information like your name, address or a credit card number. In my experience, some call centers stop the recording when you’re about to exchange credit card numbers, for example, but that’s not always the case.
With this new feature, Transcribe can automatically identify information like a social security number, credit card number, bank account number, name, email address, phone number and mailing address and redact that. The tool automatically replaces this information with ‘[PII]’ in the transcript.
There are, of course, other tools that can remove PII from existing documents. Often, though, these are focused on data loss prevention tools and aim to keep data from leaking out of the company when you share documents with outsiders. With this new Transcribe tool, at least some of this data will never be available for sharing (unless, of course, you keep a copy of the audio).
In total, Transcribe currently supports 31 languages. Of those, it can transcribe 6 in real-time for captioning and other use cases.
Here’s a fun one. How might we create a set of those cool Matryoshka dolls where they nest inside one another... but in CSS?
I toyed with this idea in my head for a little while. Then, I saw a tweet from CSS-Tricks and the article image had the dolls. I took that as a sign! It was time to put fingers to the keyboard.
Our goal here is to make these fun and interactive, where we can click on a doll to open it up and reveal another, smaller doll. Oh, and stick with just CSS for the functionality. And while we’re at it, let’s replace the dolls with our own character, say a CodePen bear. Something like this:
We won't dwell on making things pretty to start. Let's get some markup on the page and thrash out the mechanics first.
We can’t have an infinite amount of dolls. When we reach the innermost doll, it'd be nice to be able to reset the dolls without having to do a page refresh. A neat trick for this is to wrap our scene in an HTML form. That way we can use an input and set the type attribute to reset to avoid using any JavaScript.
<form>
<input type="reset" id="reset"/>
<label for="reset" title="Reset">Reset</label>
</form>Next, we need some dolls. Or bears. Or something to start with. The key here will be to use the classic checkbox hack and any associated form labels. As a note, I’m going to use Pug to handle the markup because it supports loops, making things a little easier. But, you can certainly write the HTML by hand. Here’s the start with form fields and labels that set up the checkbox hack.
Try clicking some of the inputs and hitting the Reset input. They all become unchecked. Nice, we’ll use that.
We have some interactivity but nothing is really happening yet. Here’s the plan:
The trick will be to make use of the CSS adjacent sibling combinator (+).
input:checked + label + input + label {
display: block;
}When a checkbox is checked, we need to show the label for the next doll, which will be three siblings along in the DOM. How do we make the first label visible? Give it an explicit display: block via inline styles in our markup. Putting this together, we have something along these lines:
Clicking each label reveals the next. Hold on, the last label isn’t shown! That’s correct. And that’s because the last label doesn’t have a checkbox. We need to add a rule that caters to that last label.
input:checked + label + input + label,
input:checked + label + label {
display: block;
}Cool. We're getting somewhere. That's the basic mechanics. Now things are going to get a little trickier.
So, you might be thinking, “Why aren’t we hiding the checked label?” Good question! But, if we hide it straight away, we won’t have any transition between the current doll and the next. Before we start animating our dolls, let’s create basic boxes that will represent a doll. We can style them up so they mimic the doll outline without the detail.
.doll {
color: #fff;
cursor: pointer;
height: 200px;
font-size: 2rem;
left: 50%;
position: absolute;
text-align: center;
top: 50%;
transform: translate(-50%, -50%);
width: 100px;
}
.doll:nth-of-type(even) {
background: #00f;
}
.doll:nth-of-type(odd) {
background: #f00;
}Clicking one doll instantly reveals the next one and, when we’ve reached the last doll, we can reset the form to start again. That’s what we want here.
We are going to animate the dolls based on a center point. Our animation will consist of many steps:
Let’s start by sliding the current doll out to the left. We apply an animation when we click a label. Using the :checked pseudo-selector we can target the current doll. At this point, it’s worth noting that we are going to use CSS variables to control animation speed and behavior. This will make it easier to chain animations on the labels.
:root {
--speed: 0.25;
--base-slide: 100;
--slide-distance: 60;
}
input:checked + label {
animation: slideLeft calc(var(--speed) * 1s) forwards;
}
@keyframes slideLeft {
to {
transform: translate(calc((var(--base-slide) * -1px) + var(--slide-distance) * -1%), 0);
}
}That looks great. But there’s an issue. As soon as we click a label, we could click it again and reset the animation. We don't want that to happen.
How can we get around this? We can remove pointer events from a label once it’s been clicked.
input:checked + label {
animation: slideLeft calc(var(--speed) * 1s) forwards;
pointer-events: none;
}
Great! Now once we have started, we can’t stop the animation chain from happening.
Next up, we need to crack open the doll to reveal the next one. This is where things get tricky because we are going to need some extra elements, not only to create the effect that the doll is opening up, but also to reveal the next doll inside of it. That's right: we need to duplicate the inner doll. The trick here is to reveal a "fake" doll that we swap for the real one once we've animated it. This also means delaying the reveal of the next label.
Now our markup updates labels so that they contains span elements.
<label class="doll" for="doll--1">
<span class="doll doll--dummy"></span>
<span class="doll__half doll__half--top">Top</span>
<span class="doll__half doll__half--bottom">Bottom</span>
</label>These will act as the “dummy” doll as well as the lid and base for the current doll.
.doll {
color: #fff;
cursor: pointer;
height: 200px;
font-size: 2rem;
position: absolute;
text-align: center;
width: 100px;
}
.doll:nth-of-type(even) {
--bg: #00f;
--dummy-bg: #f00;
}
.doll:nth-of-type(odd) {
--bg: #f00;
--dummy-bg: #00f;
}
.doll__half {
background: var(--bg);
position: absolute;
width: 100%;
height: 50%;
left: 0;
}
.doll__half--top {
top: 0;
}
.doll__half--bottom {
bottom: 0;
}
.doll__dummy {
background: var(--dummy-bg);
height: 100%;
width: 100%;
position: absolute;
top: 0;
left: 0;
}The lid requires three translations to create the opening effect: one to pop it up, one to move it left and then one to pop it down.
@keyframes open {
0% {
transform: translate(0, 0);
}
33.333333333333336% {
transform: translate(0, -100%);
}
66.66666666666667% {
transform: translate(-100%, -100%);
}
100% {
transform: translate(-100%, 100%);
}
}Next is where we can use CSS custom properties to handle changing values. Once the doll has slid over to the left, we can open it. But how do we know how long to delay it from opening until that happens? We can use the --speed custom property we defined earlier to calculate the correct delay.
It looks a little quick if we use the --speed value as it is, so let’s multiply it by two seconds:
input:checked + .doll {
animation: slideLeft calc(var(--speed) * 1s) forwards;
pointer-events: none;
}
input:checked + .doll .doll__half--top {
animation: open calc(var(--speed) * 2s) calc(var(--speed) * 1s) forwards; // highlight
}Much better:
Now we need to move the inner “dummy” doll to the new position. This animation is like the open animation in that it consists of three stages. Again, that’s one to move up, one to move right, and one to set down. It's like the slide animation, too. We are going to use CSS custom properties to determine the distance that the doll moves.
:root {
// Introduce a new variable that defines how high the dummy doll should pop out.
--pop-height: 60;
}
@keyframes move {
0% {
transform: translate(0, 0) translate(0, 0);
}
33.333333333333336% {
transform: translate(0, calc(var(--pop-height) * -1%)) translate(0, 0);
}
66.66666666666667% {
transform: translate(0, calc(var(--pop-height) * -1%)) translate(calc((var(--base-slide) * 1px) + var(--slide-distance) * 1%), 0);
}
100% {
transform: translate(0, calc(var(--pop-height) * -1%)) translate(calc((var(--base-slide) * 1px) + var(--slide-distance) * 1%), calc(var(--pop-height) * 1%));
}
}Almost there!
The only thing is that the next doll is available as soon as we click a doll. that means we can spam click our way through the set.
Technically, the next doll shouldn’t show until the “fake” one has moved into place. It’s only once the “fake” doll is in place that we can hide it and reveal the real one. That means we going to use zero-second scale animations! That's right. We can play pretend by delaying two zero-second animations and using animation-fill-mode.
@keyframes appear {
from {
transform: scale(0);
}
}We actually only need one set of @keyframes. because we can re-use what we have to create the opposite movement with animation-direction: reverse. With that in mind, all our animations get applied something like this:
// The next doll
input:checked + .doll + input + .doll,
// The last doll (doesn't have an input)
input:checked + .doll + .doll {
animation: appear 0s calc(var(--speed) * 5s) both;
display: block;
}
// The current doll
input:checked + .doll,
// The current doll that isn't the first. Specificity prevails
input:checked + .doll + input:checked + .doll {
animation: slideLeft calc(var(--speed) * 1s) forwards;
pointer-events: none;
}
input:checked + .doll .doll__half--top,
input:checked + .doll + input:checked + .doll .doll__half--top {
animation: open calc(var(--speed) * 2s) calc(var(--speed) * 1s) forwards;
}
input:checked + .doll .doll__dummy,
input:checked + .doll + input:checked + .doll .doll__dummy {
animation: move calc(var(--speed) * 2s) calc(var(--speed) * 3s) forwards, appear 0s calc(var(--speed) * 5s) reverse forwards;
}Note how important the variables are, especially where we are chaining animations. That gets us almost where we need to be.
I can hear it now: "They're all the same size!" Yep. That's the missing piece. They need to scale down. The trick here is to adjust the markup again and make use of CSS custom properties yet again.
<input id="doll--0" type="checkbox"/>
<label class="doll" for="doll--0" style="display: block; --doll-index: 0;">
<span class="doll__dummy-container">
<span class="doll__dummy"></span>
</span> //highlight
<span class="doll__container">
<span class="doll__half doll__half--top"></span>
<span class="doll__half doll__half--bottom"></span>
</span>
</label>We just introduced a CSS custom property inline that tells us the index of the doll. We can use this to generate a scale of each half as well as the fake inner doll. The halves will have to scale to match the actual doll size, but the fake inner doll scale will need to match that of the next doll. Tricky!
We can apply these scales inside the containers so that our animations are not affected.
:root {
--scale-step: 0.05;
}
.doll__container,
.doll__dummy-container {
height: 100%;
left: 0;
position: absolute;
top: 0;
width: 100%;
}
.doll__container {
transform: scale(calc(1 - ((var(--doll-index)) * var(--scale-step))));
transform-origin: bottom;
}
.doll__dummy {
height: 100%;
left: 0;
position: absolute;
top: 0;
transform: scale(calc(1 - ((var(--doll-index) + 1) * var(--scale-step))));
transform-origin: bottom center;
width: 100%;
}Note how the .doll__dummy class uses var(--doll-index) + 1) to calculate the scale so that it matches the next doll. 👍
Lastly, we re-assign the animation to the .doll__dummy-container class instead of the .doll__dummy class.
input:checked + .doll .doll__dummy-container,
input:checked + .doll + input:checked + .doll .doll__dummy-container {
animation: move calc(var(--speed) * 2s) calc(var(--speed) * 3s) forwards, appear 0s calc(var(--speed) * 5s) reverse forwards;
}Here's a demo where the containers have been given a background color to see what’s happening.
We can see that, although the content size changes, they remain the same size. This makes for consistent animation behavior and makes the code easier to maintain.
Wow, things are looking pretty slick! All we need are some finishing touches and we are done!
The scene starts to look cluttered because we’re stacking the “old” dolls off to the side when a new one is introduced. So let's slide a doll out of view when the next one is revealed to clean that mess up.
@keyframes slideOut {
from {
transform: translate(calc((var(--base-slide) * -1px) + var(--slide-distance) * -1%), 0);
}
to {
opacity: 0;
transform: translate(calc((var(--base-slide) * -1px) + var(--slide-distance) * -2%), 0);
}
}
input:checked + .doll,
input:checked + .doll + input:checked + .doll {
animation: slideLeft calc(var(--speed) * 1s) forwards,
slideOut calc(var(--speed) * 1s) calc(var(--speed) * 6s) forwards;
pointer-events: none;
}The new slideOut animation fades the doll out while it translates to the left. Perfect. 👍
That’s it for the CSS trickery we need to make this effect work. All that’s left style the dolls and the scene.
We have many options to style the dolls. We could use a background image, CSS illustration, SVG, or what have you. We could even throw together some emoji dolls that use random inline hues!
Let’s go with inline SVG.
I’m basically using the same underlying mechanics we’ve already covered. The difference is that I’m also generating inline variables for hue and lightness so the bears sport different shirt colors.
There we have it! Stacking dolls — err, bears — with nothing but HTML and CSS! All the code for all the steps is available in this CodePen collection. Questions or suggestions? Feel free to reach out to me here in the comments.
The post Animated Matryoshka Dolls in CSS appeared first on CSS-Tricks.
GraphQL is becoming popular and developers are constantly looking for frameworks that make it easy to set up a fast, secure and scalable GraphQL API. In this article, we will learn how to create a scalable and fast GraphQL API with authentication and fine-grained data-access control (authorization). As an example, we’ll build an API with register and login functionality. The API will be about users and confidential files so we’ll define advanced authorization rules that specify whether a logged-in user can access certain files.
By using FaunaDB’s native GraphQL and security layer, we receive all the necessary tools to set up such an API in minutes. FaunaDB has a free tier so you can easily follow along by creating an account at https://dashboard.fauna.com/. Since FaunaDB automatically provides the necessary indexes and translates each GraphQL query to one FaunaDB query, your API is also as fast as it can be (no n+1 problems!).
Setting up the API is simple: drop in a schema and we are ready to start. So let’s get started!
We need an example use-case that demonstrates how security and GraphQL API features can work together. In this example, there are users and files. Some files can be accessed by all users, and some are only meant to be accessed by managers. The following GraphQL schema will define our model:
type User {
username: String! @unique
role: UserRole!
}
enum UserRole {
MANAGER
EMPLOYEE
}
type File {
content: String!
confidential: Boolean!
}
input CreateUserInput {
username: String!
password: String!
role: UserRole!
}
input LoginUserInput {
username: String!
password: String!
}
type Query {
allFiles: [File!]!
}
type Mutation {
createUser(input: CreateUserInput): User! @resolver(name: "create_user")
loginUser(input: LoginUserInput): String! @resolver(name: "login_user")
}When looking at the schema, you might notice that the createUser and loginUser Mutation fields have been annotated with a special directive named @resolver. This is a directive provided by the FaunaDB GraphQL API, which allows us to define a custom behavior for a given Query or Mutation field. Since we’ll be using FaunaDB’s built-in authentication mechanisms, we will need to define this logic in FaunaDB after we import the schema.
First, let’s import the example schema into a new database. Log into the FaunaDB Cloud Console with your credentials. If you don’t have an account yet, you can sign up for free in a few seconds.
Once logged in, click the "New Database" button from the home page:
Choose a name for the new database, and click the "Save" button:
Next, we will import the GraphQL schema listed above into the database we just created. To do so, create a file named schema.gql containing the schema definition. Then, select the GRAPHQL tab from the left sidebar, click the "Import Schema" button, and select the newly-created file:
The import process creates all of the necessary database elements, including collections and indexes, for backing up all of the types defined in the schema. It automatically creates everything your GraphQL API needs to run efficiently.
You now have a fully functional GraphQL API which you can start testing out in the GraphQL playground. But we do not have data yet. More specifically, we would like to create some users to start testing our GraphQL API. However, since users will be part of our authentication, they are special: they have credentials and can be impersonated. Let’s see how we can create some users with secure credentials!
Remember the createUser and loginUser mutation fields that have been annotated with a special directive named @resolver. createUser is exactly what we need to start creating users, however the schema did not really define how a user needs to created; instead, it was tagged with a @resolver tag.
By tagging a specific mutation with a custom resolver such as @resolver(name: "create_user") we are informing FaunaDB that this mutation is not implemented yet but will be implemented by a User-defined function (UDF). Since our GraphQL schema does not know how to express this, the import process will only create a function template which we still have to fill in.
A UDF is a custom FaunaDB function, similar to a stored procedure, that enables users to define a tailor-made operation in Fauna’s Query Language (FQL). This function is then used as the resolver of the annotated field.
We will need a custom resolver since we will take advantage of the built-in authentication capabilities which can not be expressed in standard GraphQL. FaunaDB allows you to set a password on any database entity. This password can then be used to impersonate this database entity with the Login function which returns a token with certain permissions. The permissions that this token holds depend on the access rules that we will write.
Let’s continue to implement the UDF for the createUser field resolver so that we can create some test users. First, select the Shell tab from the left sidebar:
As explained before, a template UDF has already been created during the import process. When called, this template UDF prints an error message stating that it needs to be updated with a proper implementation. In order to update it with the intended behavior, we are going to use FQL's Update function.
So, let’s copy the following FQL query into the web-based shell, and click the "Run Query" button:
Update(Function("create_user"), {
"body": Query(
Lambda(["input"],
Create(Collection("User"), {
data: {
username: Select("username", Var("input")),
role: Select("role", Var("input")),
},
credentials: {
password: Select("password", Var("input"))
}
})
)
)
});Your screen should look similar to:
The create_user UDF will be in charge of properly creating a User document along with a password value. The password is stored in the document within a special object named credentials that is encrypted and cannot be retrieved back by any FQL function. As a result, the password is securely saved in the database making it impossible to read from either the FQL or the GraphQL APIs. The password will be used later for authenticating a User through a dedicated FQL function named Login, as explained next.
Now, let’s add the proper implementation for the UDF backing up the loginUser field resolver through the following FQL query:
Update(Function("login_user"), {
"body": Query(
Lambda(["input"],
Select(
"secret",
Login(
Match(Index("unique_User_username"), Select("username", Var("input"))),
{ password: Select("password", Var("input")) }
)
)
)
)
});Copy the query listed above and paste it into the shell’s command panel, and click the "Run Query" button:
The login_user UDF will attempt to authenticate a User with the given username and password credentials. As mentioned before, it does so via the Login function. The Login function verifies that the given password matches the one stored along with the User document being authenticated. Note that the password stored in the database is not output at any point during the login process. Finally, in case the credentials are valid, the login_user UDF returns an authorization token called a secret which can be used in subsequent requests for validating the User’s identity.
With the resolvers in place, we will continue with creating some sample data. This will let us try out our use case and help us better understand how the access rules are defined later on.
First, we are going to create a manager user. Select the GraphQL tab from the left sidebar, copy the following mutation into the GraphQL Playground, and click the "Play" button:
mutation CreateManagerUser {
createUser(input: {
username: "bill.lumbergh"
password: "123456"
role: MANAGER
}) {
username
role
}
}Your screen should look like this:
Next, let’s create an employee user by running the following mutation through the GraphQL Playground editor:
mutation CreateEmployeeUser {
createUser(input: {
username: "peter.gibbons"
password: "abcdef"
role: EMPLOYEE
}) {
username
role
}
}You should see the following response:
Now, let’s create a confidential file by running the following mutation:
mutation CreateConfidentialFile {
createFile(data: {
content: "This is a confidential file!"
confidential: true
}) {
content
confidential
}
}As a response, you should get the following:
And lastly, create a public file with the following mutation:
mutation CreatePublicFile {
createFile(data: {
content: "This is a public file!"
confidential: false
}) {
content
confidential
}
}If successful, it should prompt the following response:
Now that all the sample data is in place, we need access rules since this article is about securing a GraphQL API. The access rules determine how the sample data we just created can be accessed, since by default a user can only access his own user entity. In this case, we are going to implement the following access rules:
As you might have already noticed, these access rules are highly specific. We will see however that the ABAC system is powerful enough to express very complex rules without getting in the way of the design of your GraphQL API.
Such access rules are not part of the GraphQL specification so we will define the access rules in the Fauna Query Language (FQL), and then verify that they are working as expected by executing some queries from the GraphQL API.
But what is this "ABAC" system that we just mentioned? What does it stand for, and what can it do?
ABAC stands for Attribute-Based Access Control. As its name indicates, it’s an authorization model that establishes access policies based on attributes. In simple words, it means that you can write security rules that involve any of the attributes of your data. If our data contains users we could use the role, department, and clearance level to grant or refuse access to specific data. Or we could use the current time, day of the week, or location of the user to decide whether he can access a specific resource.
In essence, ABAC allows the definition of fine-grained access control policies based on environmental properties and your data. Now that we know what it can do, let’s define some access rules to give you concrete examples.
In FaunaDB, access rules are defined in the form of roles. A role consists of the following data:
Roles are created through the CreateRole FQL function, as shown in the following example snippet:
CreateRole({
name: "role_name",
membership: [ // ... ],
privileges: [ // ... ]
})You can see two important concepts in this role; membership and privileges. Membership defines who receives the privileges of the role and privileges defines what these permissions are. Let’s write a simple example rule to start with: “Any user can read all files.”
Since the rule applies on all users, we would define the membership like this:
membership: {
resource: Collection("User")
}Simple right? We then continue to define the "Can read all files" privilege for all of these users.
privileges: [
{
resource: Collection("File"),
actions: { read: true }
}
]The direct effect of this is that any token that you receive by logging in with a user via our loginUser GraphQL mutation can now access all files.
This is the simplest rule that we can write, but in our example we want to limit access to some confidential files. To do that, we can replace the {read: true} syntax with a function. Since we have defined that the resource of the privilege is the "File" collection, this function will take each file that would be accessed by a query as the first parameter. You can then write rules such as: “A user can only access a file if it is not confidential”. In FaunaDB’s FQL, such a function is written by using Query(Lambda(‘x’, … <logic that users Var(‘x’)>)).
Below is the privilege that would only provide read access to non-confidential files:
privileges: [
{
resource: Collection("File"),
actions: {
// Read and establish rule based on action attribute
read: Query(
// Read and establish rule based on resource attribute
Lambda("fileRef",
Not(Select(["data", "confidential"], Get(Var("fileRef"))))
)
)
}
}
]This directly uses properties of the "File" resource we are trying to access. Since it’s just a function, we could also take into account environmental properties like the current time. For example, let’s write a rule that only allows access on weekdays.
privileges: [
{
resource: Collection("File"),
actions: {
read: Query(
Lambda("fileRef",
Let(
{
dayOfWeek: DayOfWeek(Now())
},
And(GTE(Var("dayOfWeek"), 1), LTE(Var("dayOfWeek"), 5))
)
)
)
}
}
]As mentioned in our rules, confidential files should only be accessible by managers. Managers are also users, so we need a rule that applies to a specific segment of our collection of users. Luckily, we can also define the membership as a function; for example, the following Lambda only considers users who have the MANAGER role to be part of the role membership.
membership: {
resource: Collection("User"),
predicate: Query( // Read and establish rule based on user attribute
Lambda("userRef",
Equals(Select(["data", "role"], Get(Var("userRef"))), "MANAGER")
)
)
}In sum, FaunaDB roles are very flexible entities that allow defining access rules based on all of the system elements' attributes, with different levels of granularity. The place where the rules are defined — privileges or membership — determines their granularity and the attributes that are available, and will differ with each particular use case.
Now that we have covered the basics of how roles work, let’s continue by creating the access rules for our example use case!
In order to keep things neat and tidy, we’re going to create two roles: one for each of the access rules. This will allow us to extend the roles with further rules in an organized way if required later. Nonetheless, be aware that all of the rules could also have been defined together within just one role if needed.
Let’s implement the first rule:
“Allow employee users to read public files only.”
In order to create a role meeting these conditions, we are going to use the following query:
CreateRole({
name: "employee_role",
membership: {
resource: Collection("User"),
predicate: Query(
Lambda("userRef",
// User attribute based rule:
// It grants access only if the User has EMPLOYEE role.
// If so, further rules specified in the privileges
// section are applied next.
Equals(Select(["data", "role"], Get(Var("userRef"))), "EMPLOYEE")
)
)
},
privileges: [
{
// Note: 'allFiles' Index is used to retrieve the
// documents from the File collection. Therefore,
// read access to the Index is required here as well.
resource: Index("allFiles"),
actions: { read: true }
},
{
resource: Collection("File"),
actions: {
// Action attribute based rule:
// It grants read access to the File collection.
read: Query(
Lambda("fileRef",
Let(
{
file: Get(Var("fileRef")),
},
// Resource attribute based rule:
// It grants access to public files only.
Not(Select(["data", "confidential"], Var("file")))
)
)
)
}
}
]
})Select the Shell tab from the left sidebar, copy the above query into the command panel, and click the "Run Query" button:
Next, let’s implement the second access rule:
“Allow manager users to read both public files and, only during weekdays, confidential files.”
In this case, we are going to use the following query:
CreateRole({
name: "manager_role",
membership: {
resource: Collection("User"),
predicate: Query(
Lambda("userRef",
// User attribute based rule:
// It grants access only if the User has MANAGER role.
// If so, further rules specified in the privileges
// section are applied next.
Equals(Select(["data", "role"], Get(Var("userRef"))), "MANAGER")
)
)
},
privileges: [
{
// Note: 'allFiles' Index is used to retrieve
// documents from the File collection. Therefore,
// read access to the Index is required here as well.
resource: Index("allFiles"),
actions: { read: true }
},
{
resource: Collection("File"),
actions: {
// Action attribute based rule:
// It grants read access to the File collection.
read: Query(
Lambda("fileRef",
Let(
{
file: Get(Var("fileRef")),
dayOfWeek: DayOfWeek(Now())
},
Or(
// Resource attribute based rule:
// It grants access to public files.
Not(Select(["data", "confidential"], Var("file"))),
// Resource and environmental attribute based rule:
// It grants access to confidential files only on weekdays.
And(
Select(["data", "confidential"], Var("file")),
And(GTE(Var("dayOfWeek"), 1), LTE(Var("dayOfWeek"), 5))
)
)
)
)
)
}
}
]
})Copy the query into the command panel, and click the "Run Query" button:
At this point, we have created all of the necessary elements for implementing and trying out our example use case! Let’s continue with verifying that the access rules we just created are working as expected...
Let’s start by checking the first rule:
“Allow employee users to read public files only.”
The first thing we need to do is log in as an employee user so that we can verify which files can be read on its behalf. In order to do so, execute the following mutation from the GraphQL Playground console:
mutation LoginEmployeeUser {
loginUser(input: {
username: "peter.gibbons"
password: "abcdef"
})
}As a response, you should get a secret access token. The secret represents that the user has been authenticated successfully:
At this point, it’s important to remember that the access rules we defined earlier are not directly associated with the secret that is generated as a result of the login process. Unlike other authorization models, the secret token itself does not contain any authorization information on its own, but it’s just an authentication representation of a given document.
As explained before, access rules are stored in roles, and roles are associated with documents through their membership configuration. After authentication, the secret token can be used in subsequent requests to prove the caller’s identity and determine which roles are associated with it. This means that access rules are effectively verified in every subsequent request and not only during authentication. This model enables us to modify access rules dynamically without requiring users to authenticate again.
Now, we will use the secret issued in the previous step to validate the identity of the caller in our next query. In order to do so, we need to include the secret as a Bearer Token as part of the request. To achieve this, we have to modify the Authorization header value set by the GraphQL Playground. Since we don’t want to miss the admin secret that is being used as default, we’re going to do this in a new tab.
Click the plus (+) button to create a new tab, and select the HTTP HEADERS panel on the bottom left corner of the GraphQL Playground editor. Then, modify the value of the Authorization header to include the secret obtained earlier, as shown in the following example. Make sure to change the scheme value from Basic to Bearer as well:
{
"authorization": "Bearer fnEDdByZ5JACFANyg5uLcAISAtUY6TKlIIb2JnZhkjU-SWEaino"
}With the secret properly set in the request, let’s try to read all of the files on behalf of the employee user. Run the following query from the GraphQL Playground:
query ReadFiles {
allFiles {
data {
content
confidential
}
}
}In the response, you should see the public file only:
Since the role we defined for employee users does not allow them to read confidential files, they have been correctly filtered out from the response!
Let’s move on now to verifying our second rule:
“Allow manager users to read both public files and, only during weekdays, confidential files.”
This time, we are going to log in as the employee user. Since the login mutation requires an admin secret token, we have to go back first to the original tab containing the default authorization configuration. Once there, run the following query:
mutation LoginManagerUser {
loginUser(input: {
username: "bill.lumbergh"
password: "123456"
})
}You should get a new secret as a response:
Copy the secret, create a new tab, and modify the Authorization header to include the secret as a Bearer Token as we did before. Then, run the following query in order to read all of the files on behalf of the manager user:
query ReadFiles {
allFiles {
data {
content
confidential
}
}
}As long as you’re running this query on a weekday (if not, feel free to update this rule to include weekends), you should be getting both the public and the confidential file in the response:
And, finally, we have verified that all of the access rules are working successfully from the GraphQL API!
In this post, we have learned how a comprehensive authorization model can be implemented on top of the FaunaDB GraphQL API using FaunaDB's built-in ABAC features. We have also reviewed ABAC's distinctive capabilities, which allow defining complex access rules based on the attributes of each system component.
While access rules can only be defined through the FQL API at the moment, they are effectively verified for every request executed against the FaunaDB GraphQL API. Providing support for specifying access rules as part of the GraphQL schema definition is already planned for the future.
In short, FaunaDB provides a powerful mechanism for defining complex access rules on top of the GraphQL API covering most common use cases without the need for third-party services.
The post Instant GraphQL Backend with Fine-grained Security Using FaunaDB appeared first on CSS-Tricks.
With a high of F and a low of 56F. Currently, it's 67F and Clear outside. Current wind speeds: 7 from the East Pollen: 3 Sunrise...
