Extract session directive in a dedicated package

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/gqlutils/directives/session/schema.graphql

@@ -0,0 +1,38 @@
+# Session directive for GraphQL APIs
+# Include this schema in your gqlgen configuration to enable session-based access control.
+#
+# Usage in your schema.graphql:
+#   type Query {
+#     viewer: User @session(required: PRESENT)
+#     publicData: Data @session(required: OPTIONAL)
+#     signup(input: SignUpInput!): SignUpPayload @session(required: NONE)
+#   }
+
+directive @session(required: SessionRequirement!) on FIELD_DEFINITION
+
+enum SessionRequirement
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirement"
+  ) {
+  """
+  Requires an authenticated session or API key.
+  """
+  PRESENT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementPresent"
+    )
+  """
+  Forbids authenticated access (e.g., for login/signup endpoints).
+  """
+  NONE
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementNone"
+    )
+  """
+  Allows both authenticated and unauthenticated access.
+  """
+  OPTIONAL
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementOptional"
+    )
+}

pkg/server/gqlutils/directives/session/session.go

@@ -0,0 +1,108 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package session
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/99designs/gqlgen/graphql"
+	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/gqlutils"
+)
+
+type SessionRequirement string
+
+const (
+	SessionRequirementPresent  SessionRequirement = "PRESENT"
+	SessionRequirementNone     SessionRequirement = "NONE"
+	SessionRequirementOptional SessionRequirement = "OPTIONAL"
+)
+
+var AllSessionRequirement = []SessionRequirement{
+	SessionRequirementPresent,
+	SessionRequirementNone,
+	SessionRequirementOptional,
+}
+
+func (e SessionRequirement) IsValid() bool {
+	switch e {
+	case SessionRequirementPresent, SessionRequirementNone, SessionRequirementOptional:
+		return true
+	}
+	return false
+}
+
+func (e SessionRequirement) String() string {
+	return string(e)
+}
+
+func (e *SessionRequirement) UnmarshalGQL(v any) error {
+	str, ok := v.(string)
+	if !ok {
+		return fmt.Errorf("enums must be strings")
+	}
+
+	*e = SessionRequirement(str)
+	if !e.IsValid() {
+		return fmt.Errorf("%s is not a valid SessionRequirement", str)
+	}
+	return nil
+}
+
+func (e SessionRequirement) MarshalGQL(w io.Writer) {
+	fmt.Fprint(w, strconv.Quote(e.String()))
+}
+
+func (e *SessionRequirement) UnmarshalJSON(b []byte) error {
+	s, err := strconv.Unquote(string(b))
+	if err != nil {
+		return err
+	}
+	return e.UnmarshalGQL(s)
+}
+
+func (e SessionRequirement) MarshalJSON() ([]byte, error) {
+	var buf bytes.Buffer
+	e.MarshalGQL(&buf)
+	return buf.Bytes(), nil
+}
+
+func Directive(ctx context.Context, obj any, next graphql.Resolver, required SessionRequirement) (any, error) {
+	identity := authn.IdentityFromContext(ctx)
+
+	switch required {
+	case SessionRequirementOptional:
+	case SessionRequirementPresent:
+		if identity == nil {
+			return nil, gqlutils.Unauthenticatedf(
+				ctx,
+				"authentication is required to access this resouce",
+			)
+		}
+	case SessionRequirementNone:
+		if identity != nil {
+			return nil, gqlutils.Invalidf(
+				ctx,
+				"authentication not allowed for this resource/action",
+			)
+		}
+	}
+
+	return next(ctx)
+}