Add role management

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/gqlutils/errors.go

@@ -29,6 +29,15 @@ func Unauthorized() *gqlerror.Error {
 	}
 }
 
+func Forbidden(err error) *gqlerror.Error {
+	return &gqlerror.Error{
+		Message: err.Error(),
+		Extensions: map[string]any{
+			"code": "FORBIDDEN",
+		},
+	}
+}
+
 func AuthenticationRequired(details map[string]any) *gqlerror.Error {
 	extensions := map[string]any{"code": "AUTHENTICATION_REQUIRED"}
 	maps.Copy(extensions, details)

pkg/server/gqlutils/recovery.go

@@ -77,6 +77,11 @@ func RecoverFunc(ctx context.Context, err any) error {
 		return Unauthorized()
 	}
 
+	var permissionDeniedErr *authz.PermissionDeniedError
+	if errTyped, ok := err.(error); ok && errors.As(errTyped, &permissionDeniedErr) {
+		return Forbidden(permissionDeniedErr)
+	}
+
 	logger := httpserver.LoggerFromContext(ctx)
 	logger.Error("resolver panic", log.Any("error", err), log.Any("stack", string(debug.Stack())))