# Source: https://docs.hypermode.com/dgraph/guides/to-do-app/auth-rules.md

# Authorization Rules

> Use the @auth directive to limit access to the user’s to-dos. This step in the GraphQL tutorial walks you through authorization rules.

<Info>
  We're overhauling Dgraph's docs to make them clearer and more approachable. If
  you notice any issues during this transition or have suggestions, please
  [let us know](https://github.com/hypermodeinc/docs/issues).
</Info>

<Note>This is part 3 of [Building a To-Do List App](./introduction).</Note>

In the current state of the app, we can view anyone's todos, but we want our
to-dos to be private to us. Let's do that using the `@auth` directive to limit
that to the user's to-dos.

We want to limit the user to its own to-dos, so we will define the query in
`auth` to filter depending on the user's username.

Let's update the schema to include that, and then let's understand what is
happening there -

```graphql
type Task
  @auth(
    query: {
      rule: """
      query($USER: String!) {
          queryTask {
              user(filter: { username: { eq: $USER } }) {
                  __typename
              }
          }
      }
      """
    }
  ) {
  id: ID!
  title: String! @search(by: [fulltext])
  completed: Boolean! @search
  user: User!
}
type User {
  username: String! @id @search(by: [hash])
  name: String
  tasks: [Task] @hasInverse(field: user)
}
```

Resubmit the updated schema -

```
curl -X POST localhost:8080/admin/schema --data-binary '@schema.graphql'
```

Now let's see what does the definition inside the `auth` directive means.
Firstly, we can see that this rule applies to `query` (similarly we can define
rules on `add`, `update` etc.).

```graphql
query ($USER: String!) {
  queryTask {
    user(filter: { username: { eq: $USER } }) {
      __typename
    }
  }
}
```

The rule contains a parameter `USER` which we will use to filter the todos by a
user. As we know `queryTask` returns an array of `task` that contains the `user`
also and we want to filter it by `user`, so we compare the `username` of the
user with the `USER` passed to the auth rule (logged in user).

Now the next thing you would be wondering is that how do we pass a value for the
`USER` parameter in the auth rule since its not something that you can call, the
answer is pretty simple actually that value will be extracted from the JWT token
which we pass to our GraphQL API as a header and then it will execute the rule.

Let's see how we can do that in the next step using Auth0 as an example.