8.6 A customer gets nothing

The console's requests are ordinary GraphQL, so the gate is easy to see from curl. As staff:

LIN=$(curl -s 'http://localhost:5080/dev/token/lin?staff=true')
curl -s http://localhost:5080/trax/graphql -H "Authorization: Bearer $LIN" \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ operations { executions(take: 2) { items { name trainState failureJunction } } } }"}'

{"data":{"operations":{"executions":{"items":[{"name":"Shopfront.Trains.PlaceOrder.IPlaceOrderTrain","trainState":"COMPLETED","failureJunction":null},{"name":"Shopfront.Trains.PlaceOrder.IPlaceOrderTrain","trainState":"FAILED","failureJunction":"TakePaymentJunction"}]}}}}

As a customer, the same request is refused:

ADA=$(curl -s http://localhost:5080/dev/token/ada)
curl -s http://localhost:5080/trax/graphql -H "Authorization: Bearer $ADA" \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ operations { executions(take: 2) { items { name } } } }"}'

{"errors":[{"message":"Not authorized.","path":["operations"],"extensions":{"code":"TRAX_AUTHORIZATION"}}],"data":{"operations":null}}

The refusal names no role and no field below operations: a caller who may not see the namespace learns nothing about what is in it.

SDK Reference

UseTraxApiDashboard | AddTraxGraphQL | AddScheduler | Queries

Next: 8.7 Test it