There is a good book co-written by one of the authors of the library; Craft GraphQL APIs in Elixir with Absinthe: Flexible, Robust Services for Queries, Mutations, and Subscriptions by Bruce Williams and Ben Wilson

󠀠󠀠󠀠󠀠󠀠

Welcome to the “fun” of graphql, where you have to keep track at all times of who’s asking. You’re about to become very familiar with the word “resolvers”.

You’ll need something like this:

# in your user type
object :user do
  field!(:id, :id)
  field!(:login, :string)
  field(:email, :string, resolve: &Resolvers.UserResolver.resolve_email/3)
end

# the resolver it talks to
defmodule MyAppWeb.Resolvers.UserResolver do
  def resolve_email(%{id: user_id, email: email}, _args, %{context: %{current_user: current_user}}) do
    if current_user.id == user_id do
      {:ok, email}
    else
      {:error, :unauthorized}
    end
  end
end

In a nutshell, this overrides the way the user’s email is looked up from the user struct, and delegates it to the resolve_email method, which receives the user struct it’s acting on in the first argument. The context is available in the 3rd argument and you can check its current_user to figure out if you should be sending back the email or not.

I agree the docs are somewhat lacking, this is a basic pattern you will be doing A LOT and it took me longer than i would like to admit to figure it out too.

That’s what I opted for and it works.
Thanks a lot for you reply.