rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retrict some query and mutation to only session

Browse Source 
Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-02 17:43:00 -07:00
parent 9c4b6aff18
commit 383ea5a2d4
25 changed files with 268 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/server/api/connect/v1/gqlgen.yaml
View File

@@ -1,5 +1,6 @@
schema:
- "graphql/*.graphql"
- "../../../gqlutils/directives/authentication/schema.graphql"
- "../../../gqlutils/directives/session/schema.graphql"
exec:
@@ -22,7 +23,9 @@ call_argument_directives_with_null: true
directives:
mustBeAuthorized:
skip_runtime: false
session:
authentication:
skip_runtime: false
sessionOnly:
skip_runtime: false
models:

2
pkg/server/api/connect/v1/graphql/audit_log.graphql
View File

@@ -54,7 +54,7 @@ type AuditLogEntry implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
type AuditLogEntryConnection

10
pkg/server/api/connect/v1/graphql/base.graphql
View File

@@ -21,17 +21,17 @@ interface Node {
}
type Query {
node(id: ID!): Node @session(required: PRESENT)
viewer: Identity @session(required: PRESENT)
node(id: ID!): Node @authentication(required: PRESENT)
viewer: Identity @authentication(required: PRESENT)
ssoLoginURL(email: EmailAddr!): String
@goField(forceResolver: true)
@session(required: OPTIONAL)
@authentication(required: OPTIONAL)
oidcProviders: [OIDCProviderInfo!]!
@goField(forceResolver: true)
@session(required: OPTIONAL)
@authentication(required: OPTIONAL)
signUpEnabled: Boolean!
@goField(forceResolver: true)
@session(required: OPTIONAL)
@authentication(required: OPTIONAL)
}
type OIDCProviderInfo {

13
pkg/server/api/connect/v1/graphql/identity.graphql
View File

@@ -28,17 +28,22 @@ type Identity implements Node {
after: CursorKey
last: Int
before: CursorKey
): PersonalAPIKeyConnection @goField(forceResolver: true)
): PersonalAPIKeyConnection
@goField(forceResolver: true)
@authentication(required: PRESENT)
@sessionOnly
invitingOrganizations: [Organization!]!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
@sessionOnly
ssoLoginURL: String
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
@sessionOnly
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}

4
pkg/server/api/connect/v1/graphql/invitation.graphql
View File

@@ -7,7 +7,7 @@ type Invitation implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
enum InvitationStatus
@@ -51,7 +51,7 @@ type InvitationEdge {
extend type Mutation {
inviteUser(input: InviteUserInput!): InviteUserPayload
@session(required: PRESENT)
@authentication(required: PRESENT)
}
input InviteUserInput {

2
pkg/server/api/connect/v1/graphql/membership.graphql
View File

@@ -18,7 +18,7 @@ type Membership implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
extend type Mutation {

4
pkg/server/api/connect/v1/graphql/oauth2.graphql
View File

@@ -1,11 +1,11 @@
extend type Mutation {
authorizeDevice(
input: AuthorizeDeviceInput!
): AuthorizeDevicePayload @session(required: PRESENT)
): AuthorizeDevicePayload @authentication(required: PRESENT) @sessionOnly
approveConsent(
input: ApproveConsentInput!
): ApproveConsentPayload @session(required: PRESENT)
): ApproveConsentPayload @authentication(required: PRESENT) @sessionOnly
}

10
pkg/server/api/connect/v1/graphql/organization.graphql
View File

@@ -41,22 +41,22 @@ type Organization implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
extend type Mutation {
createOrganization(
input: CreateOrganizationInput!
): CreateOrganizationPayload @session(required: PRESENT)
): CreateOrganizationPayload @authentication(required: PRESENT)
updateOrganization(
input: UpdateOrganizationInput!
): UpdateOrganizationPayload @session(required: PRESENT)
): UpdateOrganizationPayload @authentication(required: PRESENT)
deleteOrganization(
input: DeleteOrganizationInput!
): DeleteOrganizationPayload @session(required: PRESENT)
): DeleteOrganizationPayload @authentication(required: PRESENT)
deleteOrganizationHorizontalLogo(
input: DeleteOrganizationHorizontalLogoInput!
): DeleteOrganizationHorizontalLogoPayload @session(required: PRESENT)
): DeleteOrganizationHorizontalLogoPayload @authentication(required: PRESENT)
}
input CreateOrganizationInput {

16
pkg/server/api/connect/v1/graphql/personal_api_key.graphql
View File

@@ -5,11 +5,15 @@ type PersonalAPIKey implements Node {
lastUsedAt: Datetime
createdAt: Datetime!
token: String @goField(forceResolver: true)
token: String
@goField(forceResolver: true)
@authentication(required: PRESENT)
@sessionOnly
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
@sessionOnly
}
type PersonalAPIKeyConnection
@@ -29,10 +33,14 @@ type PersonalAPIKeyEdge {
extend type Mutation {
createPersonalAPIKey(
input: CreatePersonalAPIKeyInput!
): CreatePersonalAPIKeyPayload @session(required: PRESENT)
): CreatePersonalAPIKeyPayload
@authentication(required: PRESENT)
@sessionOnly
revokePersonalAPIKey(
input: RevokePersonalAPIKeyInput!
): RevokePersonalAPIKeyPayload @session(required: PRESENT)
): RevokePersonalAPIKeyPayload
@authentication(required: PRESENT)
@sessionOnly
}
input CreatePersonalAPIKeyInput {

8
pkg/server/api/connect/v1/graphql/profile.graphql
View File

@@ -25,7 +25,7 @@ type Profile implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
enum ProfileState
@@ -97,13 +97,13 @@ type ProfileEdge {
extend type Mutation {
createUser(input: CreateUserInput!): CreateUserPayload
@session(required: PRESENT)
@authentication(required: PRESENT)
deactivateUser(input: DeactivateUserInput!): DeactivateUserPayload
updateUser(input: UpdateUserInput!): UpdateUserPayload!
archiveUser(input: ArchiveUserInput!): ArchiveUserPayload
@session(required: PRESENT)
@authentication(required: PRESENT)
removeUser(input: RemoveUserInput!): RemoveUserPayload
@session(required: PRESENT)
@authentication(required: PRESENT)
}
input CreateUserInput {

8
pkg/server/api/connect/v1/graphql/saml.graphql
View File

@@ -15,7 +15,7 @@ type SAMLConfiguration implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
type SAMLAttributeMappings {
@@ -55,13 +55,13 @@ type SAMLConfigurationEdge {
extend type Mutation {
createSAMLConfiguration(
input: CreateSAMLConfigurationInput!
): CreateSAMLConfigurationPayload @session(required: PRESENT)
): CreateSAMLConfigurationPayload @authentication(required: PRESENT) @sessionOnly
updateSAMLConfiguration(
input: UpdateSAMLConfigurationInput!
): UpdateSAMLConfigurationPayload @session(required: PRESENT)
): UpdateSAMLConfigurationPayload @authentication(required: PRESENT) @sessionOnly
deleteSAMLConfiguration(
input: DeleteSAMLConfigurationInput!
): DeleteSAMLConfigurationPayload @session(required: PRESENT)
): DeleteSAMLConfigurationPayload @authentication(required: PRESENT) @sessionOnly
}
input CreateSAMLConfigurationInput {

16
pkg/server/api/connect/v1/graphql/scim.graphql
View File

@@ -17,7 +17,7 @@ type SCIMConfiguration implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
type SCIMBridge implements Node {
@@ -33,7 +33,7 @@ type SCIMBridge implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
type Connector implements Node {
@@ -44,7 +44,7 @@ type Connector implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
enum ConnectorProvider
@@ -94,7 +94,7 @@ type SCIMEvent implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
enum SCIMEventOrderField
@@ -130,16 +130,16 @@ type SCIMEventEdge {
extend type Mutation {
createSCIMConfiguration(
input: CreateSCIMConfigurationInput!
): CreateSCIMConfigurationPayload @session(required: PRESENT)
): CreateSCIMConfigurationPayload @authentication(required: PRESENT) @sessionOnly
deleteSCIMConfiguration(
input: DeleteSCIMConfigurationInput!
): DeleteSCIMConfigurationPayload @session(required: PRESENT)
): DeleteSCIMConfigurationPayload @authentication(required: PRESENT) @sessionOnly
regenerateSCIMToken(
input: RegenerateSCIMTokenInput!
): RegenerateSCIMTokenPayload @session(required: PRESENT)
): RegenerateSCIMTokenPayload @authentication(required: PRESENT) @sessionOnly
updateSCIMBridge(
input: UpdateSCIMBridgeInput!
): UpdateSCIMBridgePayload @session(required: PRESENT)
): UpdateSCIMBridgePayload @authentication(required: PRESENT)
}
input CreateSCIMConfigurationInput {

26
pkg/server/api/connect/v1/graphql/session.graphql
View File

@@ -5,29 +5,29 @@ enum ReauthenticationReason {
}
extend type Mutation {
signIn(input: SignInInput!): SignInPayload @session(required: OPTIONAL)
signUp(input: SignUpInput!): SignUpPayload @session(required: NONE)
signOut: SignOutPayload @session(required: PRESENT)
signIn(input: SignInInput!): SignInPayload @authentication(required: OPTIONAL)
signUp(input: SignUpInput!): SignUpPayload @authentication(required: NONE)
signOut: SignOutPayload @authentication(required: PRESENT) @sessionOnly
activateAccount(
input: ActivateAccountInput!
): ActivateAccountPayload @session(required: OPTIONAL)
): ActivateAccountPayload @authentication(required: OPTIONAL)
forgotPassword(input: ForgotPasswordInput!): ForgotPasswordPayload
@session(required: NONE)
@authentication(required: NONE)
resetPassword(input: ResetPasswordInput!): ResetPasswordPayload
@session(required: NONE)
@authentication(required: NONE)
verifyEmail(input: VerifyEmailInput!): VerifyEmailPayload
@session(required: OPTIONAL)
@authentication(required: OPTIONAL)
changePassword(input: ChangePasswordInput!): ChangePasswordPayload
@session(required: PRESENT)
@authentication(required: PRESENT) @sessionOnly
changeEmail(input: ChangeEmailInput!): ChangeEmailPayload
@session(required: PRESENT)
@authentication(required: PRESENT) @sessionOnly
assumeOrganizationSession(
input: AssumeOrganizationSessionInput!
): AssumeOrganizationSessionPayload @session(required: PRESENT)
): AssumeOrganizationSessionPayload @authentication(required: PRESENT) @sessionOnly
revokeSession(input: RevokeSessionInput!): RevokeSessionPayload!
@session(required: PRESENT)
revokeAllSessions: RevokeAllSessionsPayload @session(required: PRESENT)
@authentication(required: PRESENT) @sessionOnly
revokeAllSessions: RevokeAllSessionsPayload @authentication(required: PRESENT) @sessionOnly
}
enum SessionOrderField
@@ -56,7 +56,7 @@ type Session implements Node {
permission(action: String!): Boolean!
@goField(forceResolver: true)
@session(required: PRESENT)
@authentication(required: PRESENT)
}
type SessionConnection

4
pkg/server/api/connect/v1/graphql_handler.go
View File

@@ -25,6 +25,7 @@ import (
"go.probo.inc/probo/pkg/server/api/authz"
"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/server/gqlutils/directives/authentication"
"go.probo.inc/probo/pkg/server/gqlutils/directives/session"
)
@@ -39,7 +40,8 @@ func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, baseURL *baseurl.Ba
sessionCookie: authn.NewCookie(&cookieConfig),
},
Directives: schema.DirectiveRoot{
Session: session.Directive,
Authentication: authentication.Directive,
SessionOnly: session.Directive,
},
}

1
pkg/server/api/trust/v1/gqlgen.yaml
View File

@@ -1,5 +1,6 @@
schema:
- "graphql/*.graphql"
- "../../../gqlutils/directives/authentication/schema.graphql"
- "../../../gqlutils/directives/session/schema.graphql"
exec:

6
pkg/server/api/trust/v1/graphql/auth.graphql
View File

@@ -1,10 +1,10 @@
extend type Mutation {
sendMagicLink(input: SendMagicLinkInput!): SendMagicLinkPayload
@session(required: OPTIONAL)
@authentication(required: OPTIONAL)
verifyMagicLink(input: VerifyMagicLinkInput!): VerifyMagicLinkPayload
@session(required: OPTIONAL)
@authentication(required: OPTIONAL)
updateFullName(input: UpdateFullNameInput!): UpdateFullNamePayload
@session(required: PRESENT)
@authentication(required: PRESENT) @sessionOnly
}
input SendMagicLinkInput {

2
pkg/server/api/trust/v1/graphql/base.graphql
View File

@@ -27,7 +27,7 @@ type Query {
currentTrustCenter: TrustCenter
oidcProviders: [OIDCProviderInfo!]!
@goField(forceResolver: true)
@session(required: OPTIONAL)
@authentication(required: OPTIONAL)
}
type OIDCProviderInfo {

4
pkg/server/api/trust/v1/graphql/mailing_list.graphql
View File

@@ -42,9 +42,9 @@ type MailingListSubscriber implements Node
}
extend type Mutation {
subscribeToMailingList: SubscribeToMailingListPayload! @session(required: PRESENT)
subscribeToMailingList: SubscribeToMailingListPayload! @authentication(required: PRESENT) @sessionOnly
unsubscribeFromMailingList: UnsubscribeFromMailingListPayload! @session(required: PRESENT)
unsubscribeFromMailingList: UnsubscribeFromMailingListPayload! @authentication(required: PRESENT) @sessionOnly
}
type SubscribeToMailingListPayload {

4
pkg/server/api/trust/v1/graphql/nda.graphql
View File

@@ -124,11 +124,11 @@ type ElectronicSignature implements Node {
extend type Mutation {
acceptElectronicSignature(
input: AcceptElectronicSignatureInput!
): AcceptElectronicSignaturePayload @session(required: PRESENT)
): AcceptElectronicSignaturePayload @authentication(required: PRESENT) @sessionOnly
recordSigningEvent(
input: RecordSigningEventInput!
): RecordSigningEventPayload @session(required: PRESENT)
): RecordSigningEventPayload @authentication(required: PRESENT) @sessionOnly
}
input AcceptElectronicSignatureInput {

14
pkg/server/api/trust/v1/graphql/trust_center.graphql
View File

@@ -346,29 +346,29 @@ type DocumentAccess implements Node {
}
extend type Mutation {
requestAllAccesses: RequestAccessesPayload! @session(required: PRESENT) @nda
requestAllAccesses: RequestAccessesPayload! @authentication(required: PRESENT) @nda
exportDocumentPDF(input: ExportDocumentPDFInput!): ExportDocumentPDFPayload!
@session(required: OPTIONAL) @nda
@authentication(required: OPTIONAL) @nda
exportReportPDF(input: ExportReportPDFInput!): ExportReportPDFPayload!
@session(required: OPTIONAL) @nda
@authentication(required: OPTIONAL) @nda
exportTrustCenterFile(
input: ExportTrustCenterFileInput!
): ExportTrustCenterFilePayload! @session(required: OPTIONAL) @nda
): ExportTrustCenterFilePayload! @authentication(required: OPTIONAL) @nda
requestDocumentAccess(
input: RequestDocumentAccessInput!
): RequestDocumentAccessPayload! @session(required: PRESENT) @nda
): RequestDocumentAccessPayload! @authentication(required: PRESENT) @nda
requestReportAccess(
input: RequestReportAccessInput!
): RequestReportAccessPayload! @session(required: PRESENT) @nda
): RequestReportAccessPayload! @authentication(required: PRESENT) @nda
requestTrustCenterFileAccess(
input: RequestTrustCenterFileAccessInput!
): RequestFileAccessPayload! @session(required: PRESENT) @nda
): RequestFileAccessPayload! @authentication(required: PRESENT) @nda
}
type RequestDocumentAccessPayload {

6
pkg/server/api/trust/v1/graphql_handler.go
View File

@@ -26,6 +26,7 @@ import (
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/trust/v1/schema"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/server/gqlutils/directives/authentication"
"go.probo.inc/probo/pkg/server/gqlutils/directives/session"
"go.probo.inc/probo/pkg/trust"
)
@@ -42,8 +43,9 @@ func NewGraphQLHandler(iamSvc *iam.Service, trustSvc *trust.Service, esignSvc *e
sessionCookie: authn.NewCookie(&cookieConfig),
},
Directives: schema.DirectiveRoot{
Nda: newNDADirective(logger, trustSvc, esignSvc),
Session: session.Directive,
Nda: newNDADirective(logger, trustSvc, esignSvc),
Authentication: authentication.Directive,
SessionOnly: session.Directive,
},
}

112
pkg/server/gqlutils/directives/authentication/authentication.go Normal file
View File

@@ -0,0 +1,112 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package authentication
import (
"bytes"
"context"
"fmt"
"io"
"strconv"
"github.com/99designs/gqlgen/graphql"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/gqlutils"
)
type AuthenticationRequirement string
const (
AuthenticationRequirementPresent AuthenticationRequirement = "PRESENT"
AuthenticationRequirementNone AuthenticationRequirement = "NONE"
AuthenticationRequirementOptional AuthenticationRequirement = "OPTIONAL"
)
var AllAuthenticationRequirement = []AuthenticationRequirement{
AuthenticationRequirementPresent,
AuthenticationRequirementNone,
AuthenticationRequirementOptional,
}
func (e AuthenticationRequirement) IsValid() bool {
switch e {
case AuthenticationRequirementPresent, AuthenticationRequirementNone, AuthenticationRequirementOptional:
return true
}
return false
}
func (e AuthenticationRequirement) String() string {
return string(e)
}
func (e *AuthenticationRequirement) UnmarshalGQL(v any) error {
str, ok := v.(string)
if !ok {
return fmt.Errorf("enums must be strings")
}
*e = AuthenticationRequirement(str)
if !e.IsValid() {
return fmt.Errorf("%s is not a valid AuthenticationRequirement", str)
}
return nil
}
func (e AuthenticationRequirement) MarshalGQL(w io.Writer) {
_, _ = fmt.Fprint(w, strconv.Quote(e.String()))
}
func (e *AuthenticationRequirement) UnmarshalJSON(b []byte) error {
s, err := strconv.Unquote(string(b))
if err != nil {
return err
}
return e.UnmarshalGQL(s)
}
func (e AuthenticationRequirement) MarshalJSON() ([]byte, error) {
var buf bytes.Buffer
e.MarshalGQL(&buf)
return buf.Bytes(), nil
}
func Directive(ctx context.Context, obj any, next graphql.Resolver, required AuthenticationRequirement) (any, error) {
identity := authn.IdentityFromContext(ctx)
switch required {
case AuthenticationRequirementOptional:
case AuthenticationRequirementPresent:
if identity == nil {
return nil, gqlutils.Unauthenticatedf(
ctx,
"authentication is required to access this resource",
)
}
case AuthenticationRequirementNone:
if identity != nil {
return nil, gqlutils.AlreadyAuthenticatedf(
ctx,
"authentication not allowed for this resource/action",
)
}
}
return next(ctx)
}

39
pkg/server/gqlutils/directives/authentication/schema.graphql Normal file
View File

@@ -0,0 +1,39 @@
# Authentication directive for GraphQL APIs
# Include this schema in your gqlgen configuration to enable identity-based
# access control (session OR API key).
#
# Usage in your schema.graphql:
# type Query {
# viewer: User @authentication(required: PRESENT)
# publicData: Data @authentication(required: OPTIONAL)
# signup(input: SignUpInput!): SignUpPayload @authentication(required: NONE)
# }
directive @authentication(required: AuthenticationRequirement!) on FIELD_DEFINITION
enum AuthenticationRequirement
@goModel(
model: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirement"
) {
"""
Requires an authenticated identity (session or API key).
"""
PRESENT
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementPresent"
)
"""
Forbids authenticated access (e.g., for login/signup endpoints).
"""
NONE
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementNone"
)
"""
Allows both authenticated and unauthenticated access.
"""
OPTIONAL
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementOptional"
)
}

48
pkg/server/gqlutils/directives/session/schema.graphql
View File

@@ -1,38 +1,18 @@
# Session directive for GraphQL APIs
# Include this schema in your gqlgen configuration to enable session-based access control.
# sessionOnly directive for GraphQL APIs
# Include this schema in your gqlgen configuration to restrict a field to
# session authentication.
#
# It is meant to be combined with @authentication(required: PRESENT):
# @authentication enforces that the caller is authenticated, while @sessionOnly
# additionally rejects API key authentication (which carries an identity but no
# session). Use it for sensitive identity self-management (e.g. managing
# personal API keys).
#
# Usage in your schema.graphql:
# type Query {
# viewer: User @session(required: PRESENT)
# publicData: Data @session(required: OPTIONAL)
# signup(input: SignUpInput!): SignUpPayload @session(required: NONE)
# type Mutation {
# createPersonalAPIKey(input: CreatePersonalAPIKeyInput!): CreatePersonalAPIKeyPayload
# @authentication(required: PRESENT)
# @sessionOnly
# }
directive @session(required: SessionRequirement!) on FIELD_DEFINITION
enum SessionRequirement
@goModel(
model: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirement"
) {
"""
Requires an authenticated session or API key.
"""
PRESENT
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementPresent"
)
"""
Forbids authenticated access (e.g., for login/signup endpoints).
"""
NONE
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementNone"
)
"""
Allows both authenticated and unauthenticated access.
"""
OPTIONAL
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementOptional"
)
}
directive @sessionOnly on FIELD_DEFINITION

94
pkg/server/gqlutils/directives/session/session.go
View File

@@ -15,97 +15,23 @@
package session
import (
"bytes"
"context"
"fmt"
"io"
"strconv"
"github.com/99designs/gqlgen/graphql"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/gqlutils"
)
type SessionRequirement string
const (
SessionRequirementPresent SessionRequirement = "PRESENT"
SessionRequirementNone SessionRequirement = "NONE"
SessionRequirementOptional SessionRequirement = "OPTIONAL"
)
var AllSessionRequirement = []SessionRequirement{
SessionRequirementPresent,
SessionRequirementNone,
SessionRequirementOptional,
}
func (e SessionRequirement) IsValid() bool {
switch e {
case SessionRequirementPresent, SessionRequirementNone, SessionRequirementOptional:
return true
}
return false
}
func (e SessionRequirement) String() string {
return string(e)
}
func (e *SessionRequirement) UnmarshalGQL(v any) error {
str, ok := v.(string)
if !ok {
return fmt.Errorf("enums must be strings")
}
*e = SessionRequirement(str)
if !e.IsValid() {
return fmt.Errorf("%s is not a valid SessionRequirement", str)
}
return nil
}
func (e SessionRequirement) MarshalGQL(w io.Writer) {
_, _ = fmt.Fprint(w, strconv.Quote(e.String()))
}
func (e *SessionRequirement) UnmarshalJSON(b []byte) error {
s, err := strconv.Unquote(string(b))
if err != nil {
return err
}
return e.UnmarshalGQL(s)
}
func (e SessionRequirement) MarshalJSON() ([]byte, error) {
var buf bytes.Buffer
e.MarshalGQL(&buf)
return buf.Bytes(), nil
}
func Directive(ctx context.Context, obj any, next graphql.Resolver, required SessionRequirement) (any, error) {
identity := authn.IdentityFromContext(ctx)
switch required {
case SessionRequirementOptional:
case SessionRequirementPresent:
if identity == nil {
return nil, gqlutils.Unauthenticatedf(
ctx,
"authentication is required to access this resource",
)
}
case SessionRequirementNone:
if identity != nil {
return nil, gqlutils.AlreadyAuthenticatedf(
ctx,
"authentication not allowed for this resource/action",
)
}
// Directive enforces that the request carries a real session. It is meant to
// be combined with @authentication(required: PRESENT): @authentication handles
// the "must be authenticated" check, while @sessionOnly additionally rejects
// API key authentication, which also carries an identity but no session.
func Directive(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
if authn.SessionFromContext(ctx) == nil {
return nil, gqlutils.Forbiddenf(
ctx,
"this resource can only be accessed with session authentication, not API key authentication",
)
}
return next(ctx)