Retrict some query and mutation to only session

Signed-off-by: Bryan Frimin <bryan@probo.com>
2026-06-02 17:43:00 -07:00
parent 9c4b6aff18
commit 383ea5a2d4
25 changed files with 268 additions and 190 deletions
--- a/pkg/server/api/connect/v1/gqlgen.yaml
+++ b/pkg/server/api/connect/v1/gqlgen.yaml
@@ -1,5 +1,6 @@
 schema:
  - "graphql/*.graphql"
+  - "../../../gqlutils/directives/authentication/schema.graphql"
  - "../../../gqlutils/directives/session/schema.graphql"

 exec:
@@ -22,7 +23,9 @@ call_argument_directives_with_null: true
 directives:
  mustBeAuthorized:
    skip_runtime: false
-  session:
+  authentication:
+    skip_runtime: false
+  sessionOnly:
    skip_runtime: false

 models:
--- a/pkg/server/api/connect/v1/graphql/audit_log.graphql
+++ b/pkg/server/api/connect/v1/graphql/audit_log.graphql
@@ -54,7 +54,7 @@ type AuditLogEntry implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 type AuditLogEntryConnection
--- a/pkg/server/api/connect/v1/graphql/base.graphql
+++ b/pkg/server/api/connect/v1/graphql/base.graphql
@@ -21,17 +21,17 @@ interface Node {
 }

 type Query {
-  node(id: ID!): Node @session(required: PRESENT)
-  viewer: Identity @session(required: PRESENT)
+  node(id: ID!): Node @authentication(required: PRESENT)
+  viewer: Identity @authentication(required: PRESENT)
  ssoLoginURL(email: EmailAddr!): String
    @goField(forceResolver: true)
-    @session(required: OPTIONAL)
+    @authentication(required: OPTIONAL)
  oidcProviders: [OIDCProviderInfo!]!
    @goField(forceResolver: true)
-    @session(required: OPTIONAL)
+    @authentication(required: OPTIONAL)
  signUpEnabled: Boolean!
    @goField(forceResolver: true)
-    @session(required: OPTIONAL)
+    @authentication(required: OPTIONAL)
 }

 type OIDCProviderInfo {
--- a/pkg/server/api/connect/v1/graphql/identity.graphql
+++ b/pkg/server/api/connect/v1/graphql/identity.graphql
@@ -28,17 +28,22 @@ type Identity implements Node {
    after: CursorKey
    last: Int
    before: CursorKey
-  ): PersonalAPIKeyConnection @goField(forceResolver: true)
+  ): PersonalAPIKeyConnection
+    @goField(forceResolver: true)
+    @authentication(required: PRESENT)
+    @sessionOnly

  invitingOrganizations: [Organization!]!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
+    @sessionOnly

  ssoLoginURL: String
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
+    @sessionOnly

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }
--- a/pkg/server/api/connect/v1/graphql/invitation.graphql
+++ b/pkg/server/api/connect/v1/graphql/invitation.graphql
@@ -7,7 +7,7 @@ type Invitation implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 enum InvitationStatus
@@ -51,7 +51,7 @@ type InvitationEdge {

 extend type Mutation {
  inviteUser(input: InviteUserInput!): InviteUserPayload
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 input InviteUserInput {
--- a/pkg/server/api/connect/v1/graphql/membership.graphql
+++ b/pkg/server/api/connect/v1/graphql/membership.graphql
@@ -18,7 +18,7 @@ type Membership implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 extend type Mutation {
--- a/pkg/server/api/connect/v1/graphql/oauth2.graphql
+++ b/pkg/server/api/connect/v1/graphql/oauth2.graphql
@@ -1,11 +1,11 @@
 extend type Mutation {
  authorizeDevice(
    input: AuthorizeDeviceInput!
-  ): AuthorizeDevicePayload @session(required: PRESENT)
+  ): AuthorizeDevicePayload @authentication(required: PRESENT) @sessionOnly

  approveConsent(
    input: ApproveConsentInput!
-  ): ApproveConsentPayload @session(required: PRESENT)
+  ): ApproveConsentPayload @authentication(required: PRESENT) @sessionOnly
 }


--- a/pkg/server/api/connect/v1/graphql/organization.graphql
+++ b/pkg/server/api/connect/v1/graphql/organization.graphql
@@ -41,22 +41,22 @@ type Organization implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 extend type Mutation {
  createOrganization(
    input: CreateOrganizationInput!
-  ): CreateOrganizationPayload @session(required: PRESENT)
+  ): CreateOrganizationPayload @authentication(required: PRESENT)
  updateOrganization(
    input: UpdateOrganizationInput!
-  ): UpdateOrganizationPayload @session(required: PRESENT)
+  ): UpdateOrganizationPayload @authentication(required: PRESENT)
  deleteOrganization(
    input: DeleteOrganizationInput!
-  ): DeleteOrganizationPayload @session(required: PRESENT)
+  ): DeleteOrganizationPayload @authentication(required: PRESENT)
  deleteOrganizationHorizontalLogo(
    input: DeleteOrganizationHorizontalLogoInput!
-  ): DeleteOrganizationHorizontalLogoPayload @session(required: PRESENT)
+  ): DeleteOrganizationHorizontalLogoPayload @authentication(required: PRESENT)
 }

 input CreateOrganizationInput {
--- a/pkg/server/api/connect/v1/graphql/personal_api_key.graphql
+++ b/pkg/server/api/connect/v1/graphql/personal_api_key.graphql
@@ -5,11 +5,15 @@ type PersonalAPIKey implements Node {
  lastUsedAt: Datetime
  createdAt: Datetime!

-  token: String @goField(forceResolver: true)
+  token: String
+    @goField(forceResolver: true)
+    @authentication(required: PRESENT)
+    @sessionOnly

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
+    @sessionOnly
 }

 type PersonalAPIKeyConnection
@@ -29,10 +33,14 @@ type PersonalAPIKeyEdge {
 extend type Mutation {
  createPersonalAPIKey(
    input: CreatePersonalAPIKeyInput!
-  ): CreatePersonalAPIKeyPayload @session(required: PRESENT)
+  ): CreatePersonalAPIKeyPayload
+    @authentication(required: PRESENT)
+    @sessionOnly
  revokePersonalAPIKey(
    input: RevokePersonalAPIKeyInput!
-  ): RevokePersonalAPIKeyPayload @session(required: PRESENT)
+  ): RevokePersonalAPIKeyPayload
+    @authentication(required: PRESENT)
+    @sessionOnly
 }

 input CreatePersonalAPIKeyInput {
--- a/pkg/server/api/connect/v1/graphql/profile.graphql
+++ b/pkg/server/api/connect/v1/graphql/profile.graphql
@@ -25,7 +25,7 @@ type Profile implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 enum ProfileState
@@ -97,13 +97,13 @@ type ProfileEdge {

 extend type Mutation {
  createUser(input: CreateUserInput!): CreateUserPayload
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
  deactivateUser(input: DeactivateUserInput!): DeactivateUserPayload
  updateUser(input: UpdateUserInput!): UpdateUserPayload!
  archiveUser(input: ArchiveUserInput!): ArchiveUserPayload
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
  removeUser(input: RemoveUserInput!): RemoveUserPayload
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 input CreateUserInput {
--- a/pkg/server/api/connect/v1/graphql/saml.graphql
+++ b/pkg/server/api/connect/v1/graphql/saml.graphql
@@ -15,7 +15,7 @@ type SAMLConfiguration implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 type SAMLAttributeMappings {
@@ -55,13 +55,13 @@ type SAMLConfigurationEdge {
 extend type Mutation {
  createSAMLConfiguration(
    input: CreateSAMLConfigurationInput!
-  ): CreateSAMLConfigurationPayload @session(required: PRESENT)
+  ): CreateSAMLConfigurationPayload @authentication(required: PRESENT) @sessionOnly
  updateSAMLConfiguration(
    input: UpdateSAMLConfigurationInput!
-  ): UpdateSAMLConfigurationPayload @session(required: PRESENT)
+  ): UpdateSAMLConfigurationPayload @authentication(required: PRESENT) @sessionOnly
  deleteSAMLConfiguration(
    input: DeleteSAMLConfigurationInput!
-  ): DeleteSAMLConfigurationPayload @session(required: PRESENT)
+  ): DeleteSAMLConfigurationPayload @authentication(required: PRESENT) @sessionOnly
 }

 input CreateSAMLConfigurationInput {
--- a/pkg/server/api/connect/v1/graphql/scim.graphql
+++ b/pkg/server/api/connect/v1/graphql/scim.graphql
@@ -17,7 +17,7 @@ type SCIMConfiguration implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 type SCIMBridge implements Node {
@@ -33,7 +33,7 @@ type SCIMBridge implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 type Connector implements Node {
@@ -44,7 +44,7 @@ type Connector implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 enum ConnectorProvider
@@ -94,7 +94,7 @@ type SCIMEvent implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 enum SCIMEventOrderField
@@ -130,16 +130,16 @@ type SCIMEventEdge {
 extend type Mutation {
  createSCIMConfiguration(
    input: CreateSCIMConfigurationInput!
-  ): CreateSCIMConfigurationPayload @session(required: PRESENT)
+  ): CreateSCIMConfigurationPayload @authentication(required: PRESENT) @sessionOnly
  deleteSCIMConfiguration(
    input: DeleteSCIMConfigurationInput!
-  ): DeleteSCIMConfigurationPayload @session(required: PRESENT)
+  ): DeleteSCIMConfigurationPayload @authentication(required: PRESENT) @sessionOnly
  regenerateSCIMToken(
    input: RegenerateSCIMTokenInput!
-  ): RegenerateSCIMTokenPayload @session(required: PRESENT)
+  ): RegenerateSCIMTokenPayload @authentication(required: PRESENT) @sessionOnly
  updateSCIMBridge(
    input: UpdateSCIMBridgeInput!
-  ): UpdateSCIMBridgePayload @session(required: PRESENT)
+  ): UpdateSCIMBridgePayload @authentication(required: PRESENT)
 }

 input CreateSCIMConfigurationInput {
--- a/pkg/server/api/connect/v1/graphql/session.graphql
+++ b/pkg/server/api/connect/v1/graphql/session.graphql
@@ -5,29 +5,29 @@ enum ReauthenticationReason {
 }

 extend type Mutation {
-  signIn(input: SignInInput!): SignInPayload @session(required: OPTIONAL)
-  signUp(input: SignUpInput!): SignUpPayload @session(required: NONE)
-  signOut: SignOutPayload @session(required: PRESENT)
+  signIn(input: SignInInput!): SignInPayload @authentication(required: OPTIONAL)
+  signUp(input: SignUpInput!): SignUpPayload @authentication(required: NONE)
+  signOut: SignOutPayload @authentication(required: PRESENT) @sessionOnly
  activateAccount(
    input: ActivateAccountInput!
-  ): ActivateAccountPayload @session(required: OPTIONAL)
+  ): ActivateAccountPayload @authentication(required: OPTIONAL)
  forgotPassword(input: ForgotPasswordInput!): ForgotPasswordPayload
-    @session(required: NONE)
+    @authentication(required: NONE)
  resetPassword(input: ResetPasswordInput!): ResetPasswordPayload
-    @session(required: NONE)
+    @authentication(required: NONE)
  verifyEmail(input: VerifyEmailInput!): VerifyEmailPayload
-    @session(required: OPTIONAL)
+    @authentication(required: OPTIONAL)
  changePassword(input: ChangePasswordInput!): ChangePasswordPayload
-    @session(required: PRESENT)
+    @authentication(required: PRESENT) @sessionOnly
  changeEmail(input: ChangeEmailInput!): ChangeEmailPayload
-    @session(required: PRESENT)
+    @authentication(required: PRESENT) @sessionOnly
  assumeOrganizationSession(
    input: AssumeOrganizationSessionInput!
-  ): AssumeOrganizationSessionPayload @session(required: PRESENT)
+  ): AssumeOrganizationSessionPayload @authentication(required: PRESENT) @sessionOnly

  revokeSession(input: RevokeSessionInput!): RevokeSessionPayload!
-    @session(required: PRESENT)
-  revokeAllSessions: RevokeAllSessionsPayload @session(required: PRESENT)
+    @authentication(required: PRESENT) @sessionOnly
+  revokeAllSessions: RevokeAllSessionsPayload @authentication(required: PRESENT) @sessionOnly
 }

 enum SessionOrderField
@@ -56,7 +56,7 @@ type Session implements Node {

  permission(action: String!): Boolean!
    @goField(forceResolver: true)
-    @session(required: PRESENT)
+    @authentication(required: PRESENT)
 }

 type SessionConnection
--- a/pkg/server/api/connect/v1/graphql_handler.go
+++ b/pkg/server/api/connect/v1/graphql_handler.go
@@ -25,6 +25,7 @@ import (
 	"go.probo.inc/probo/pkg/server/api/authz"
 	"go.probo.inc/probo/pkg/server/api/connect/v1/schema"
 	"go.probo.inc/probo/pkg/server/gqlutils"
+	"go.probo.inc/probo/pkg/server/gqlutils/directives/authentication"
 	"go.probo.inc/probo/pkg/server/gqlutils/directives/session"
 )

@@ -39,7 +40,8 @@ func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, baseURL *baseurl.Ba
 			sessionCookie:  authn.NewCookie(&cookieConfig),
 		},
 		Directives: schema.DirectiveRoot{
-			Session: session.Directive,
+			Authentication: authentication.Directive,
+			SessionOnly:    session.Directive,
 		},
 	}

--- a/pkg/server/api/trust/v1/gqlgen.yaml
+++ b/pkg/server/api/trust/v1/gqlgen.yaml
@@ -1,5 +1,6 @@
 schema:
  - "graphql/*.graphql"
+  - "../../../gqlutils/directives/authentication/schema.graphql"
  - "../../../gqlutils/directives/session/schema.graphql"

 exec:
--- a/pkg/server/api/trust/v1/graphql/auth.graphql
+++ b/pkg/server/api/trust/v1/graphql/auth.graphql
@@ -1,10 +1,10 @@
 extend type Mutation {
  sendMagicLink(input: SendMagicLinkInput!): SendMagicLinkPayload
-    @session(required: OPTIONAL)
+    @authentication(required: OPTIONAL)
  verifyMagicLink(input: VerifyMagicLinkInput!): VerifyMagicLinkPayload
-    @session(required: OPTIONAL)
+    @authentication(required: OPTIONAL)
  updateFullName(input: UpdateFullNameInput!): UpdateFullNamePayload
-    @session(required: PRESENT)
+    @authentication(required: PRESENT) @sessionOnly
 }

 input SendMagicLinkInput {
--- a/pkg/server/api/trust/v1/graphql/base.graphql
+++ b/pkg/server/api/trust/v1/graphql/base.graphql
@@ -27,7 +27,7 @@ type Query {
  currentTrustCenter: TrustCenter
  oidcProviders: [OIDCProviderInfo!]!
    @goField(forceResolver: true)
-    @session(required: OPTIONAL)
+    @authentication(required: OPTIONAL)
 }

 type OIDCProviderInfo {
--- a/pkg/server/api/trust/v1/graphql/mailing_list.graphql
+++ b/pkg/server/api/trust/v1/graphql/mailing_list.graphql
@@ -42,9 +42,9 @@ type MailingListSubscriber implements Node
 }

 extend type Mutation {
-  subscribeToMailingList: SubscribeToMailingListPayload! @session(required: PRESENT)
+  subscribeToMailingList: SubscribeToMailingListPayload! @authentication(required: PRESENT) @sessionOnly

-  unsubscribeFromMailingList: UnsubscribeFromMailingListPayload! @session(required: PRESENT)
+  unsubscribeFromMailingList: UnsubscribeFromMailingListPayload! @authentication(required: PRESENT) @sessionOnly
 }

 type SubscribeToMailingListPayload {
--- a/pkg/server/api/trust/v1/graphql/nda.graphql
+++ b/pkg/server/api/trust/v1/graphql/nda.graphql
@@ -124,11 +124,11 @@ type ElectronicSignature implements Node {
 extend type Mutation {
  acceptElectronicSignature(
    input: AcceptElectronicSignatureInput!
-  ): AcceptElectronicSignaturePayload @session(required: PRESENT)
+  ): AcceptElectronicSignaturePayload @authentication(required: PRESENT) @sessionOnly

  recordSigningEvent(
    input: RecordSigningEventInput!
-  ): RecordSigningEventPayload @session(required: PRESENT)
+  ): RecordSigningEventPayload @authentication(required: PRESENT) @sessionOnly
 }

 input AcceptElectronicSignatureInput {
--- a/pkg/server/api/trust/v1/graphql/trust_center.graphql
+++ b/pkg/server/api/trust/v1/graphql/trust_center.graphql
@@ -346,29 +346,29 @@ type DocumentAccess implements Node {
 }

 extend type Mutation {
-  requestAllAccesses: RequestAccessesPayload! @session(required: PRESENT) @nda
+  requestAllAccesses: RequestAccessesPayload! @authentication(required: PRESENT) @nda

  exportDocumentPDF(input: ExportDocumentPDFInput!): ExportDocumentPDFPayload!
-    @session(required: OPTIONAL) @nda
+    @authentication(required: OPTIONAL) @nda

  exportReportPDF(input: ExportReportPDFInput!): ExportReportPDFPayload!
-    @session(required: OPTIONAL) @nda
+    @authentication(required: OPTIONAL) @nda

  exportTrustCenterFile(
    input: ExportTrustCenterFileInput!
-  ): ExportTrustCenterFilePayload! @session(required: OPTIONAL) @nda
+  ): ExportTrustCenterFilePayload! @authentication(required: OPTIONAL) @nda

  requestDocumentAccess(
    input: RequestDocumentAccessInput!
-  ): RequestDocumentAccessPayload! @session(required: PRESENT) @nda
+  ): RequestDocumentAccessPayload! @authentication(required: PRESENT) @nda

  requestReportAccess(
    input: RequestReportAccessInput!
-  ): RequestReportAccessPayload! @session(required: PRESENT) @nda
+  ): RequestReportAccessPayload! @authentication(required: PRESENT) @nda

  requestTrustCenterFileAccess(
    input: RequestTrustCenterFileAccessInput!
-  ): RequestFileAccessPayload! @session(required: PRESENT) @nda
+  ): RequestFileAccessPayload! @authentication(required: PRESENT) @nda
 }

 type RequestDocumentAccessPayload {
--- a/pkg/server/api/trust/v1/graphql_handler.go
+++ b/pkg/server/api/trust/v1/graphql_handler.go
@@ -26,6 +26,7 @@ import (
 	"go.probo.inc/probo/pkg/server/api/authn"
 	"go.probo.inc/probo/pkg/server/api/trust/v1/schema"
 	"go.probo.inc/probo/pkg/server/gqlutils"
+	"go.probo.inc/probo/pkg/server/gqlutils/directives/authentication"
 	"go.probo.inc/probo/pkg/server/gqlutils/directives/session"
 	"go.probo.inc/probo/pkg/trust"
 )
@@ -42,8 +43,9 @@ func NewGraphQLHandler(iamSvc *iam.Service, trustSvc *trust.Service, esignSvc *e
 			sessionCookie: authn.NewCookie(&cookieConfig),
 		},
 		Directives: schema.DirectiveRoot{
-			Nda:     newNDADirective(logger, trustSvc, esignSvc),
-			Session: session.Directive,
+			Nda:            newNDADirective(logger, trustSvc, esignSvc),
+			Authentication: authentication.Directive,
+			SessionOnly:    session.Directive,
 		},
 	}