rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retrict some query and mutation to only session

Browse Source 
Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-02 17:43:00 -07:00
parent 9c4b6aff18
commit 383ea5a2d4
25 changed files with 268 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

112
pkg/server/gqlutils/directives/authentication/authentication.go Normal file
View File

@@ -0,0 +1,112 @@
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package authentication
import (
"bytes"
"context"
"fmt"
"io"
"strconv"
"github.com/99designs/gqlgen/graphql"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/gqlutils"
)
type AuthenticationRequirement string
const (
AuthenticationRequirementPresent AuthenticationRequirement = "PRESENT"
AuthenticationRequirementNone AuthenticationRequirement = "NONE"
AuthenticationRequirementOptional AuthenticationRequirement = "OPTIONAL"
)
var AllAuthenticationRequirement = []AuthenticationRequirement{
AuthenticationRequirementPresent,
AuthenticationRequirementNone,
AuthenticationRequirementOptional,
}
func (e AuthenticationRequirement) IsValid() bool {
switch e {
case AuthenticationRequirementPresent, AuthenticationRequirementNone, AuthenticationRequirementOptional:
return true
}
return false
}
func (e AuthenticationRequirement) String() string {
return string(e)
}
func (e *AuthenticationRequirement) UnmarshalGQL(v any) error {
str, ok := v.(string)
if !ok {
return fmt.Errorf("enums must be strings")
}
*e = AuthenticationRequirement(str)
if !e.IsValid() {
return fmt.Errorf("%s is not a valid AuthenticationRequirement", str)
}
return nil
}
func (e AuthenticationRequirement) MarshalGQL(w io.Writer) {
_, _ = fmt.Fprint(w, strconv.Quote(e.String()))
}
func (e *AuthenticationRequirement) UnmarshalJSON(b []byte) error {
s, err := strconv.Unquote(string(b))
if err != nil {
return err
}
return e.UnmarshalGQL(s)
}
func (e AuthenticationRequirement) MarshalJSON() ([]byte, error) {
var buf bytes.Buffer
e.MarshalGQL(&buf)
return buf.Bytes(), nil
}
func Directive(ctx context.Context, obj any, next graphql.Resolver, required AuthenticationRequirement) (any, error) {
identity := authn.IdentityFromContext(ctx)
switch required {
case AuthenticationRequirementOptional:
case AuthenticationRequirementPresent:
if identity == nil {
return nil, gqlutils.Unauthenticatedf(
ctx,
"authentication is required to access this resource",
)
}
case AuthenticationRequirementNone:
if identity != nil {
return nil, gqlutils.AlreadyAuthenticatedf(
ctx,
"authentication not allowed for this resource/action",
)
}
}
return next(ctx)
}

39
pkg/server/gqlutils/directives/authentication/schema.graphql Normal file
View File

@@ -0,0 +1,39 @@
# Authentication directive for GraphQL APIs
# Include this schema in your gqlgen configuration to enable identity-based
# access control (session OR API key).
#
# Usage in your schema.graphql:
# type Query {
# viewer: User @authentication(required: PRESENT)
# publicData: Data @authentication(required: OPTIONAL)
# signup(input: SignUpInput!): SignUpPayload @authentication(required: NONE)
# }
directive @authentication(required: AuthenticationRequirement!) on FIELD_DEFINITION
enum AuthenticationRequirement
@goModel(
model: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirement"
) {
"""
Requires an authenticated identity (session or API key).
"""
PRESENT
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementPresent"
)
"""
Forbids authenticated access (e.g., for login/signup endpoints).
"""
NONE
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementNone"
)
"""
Allows both authenticated and unauthenticated access.
"""
OPTIONAL
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementOptional"
)
}

48
pkg/server/gqlutils/directives/session/schema.graphql
View File

@@ -1,38 +1,18 @@
# Session directive for GraphQL APIs
# Include this schema in your gqlgen configuration to enable session-based access control.
# sessionOnly directive for GraphQL APIs
# Include this schema in your gqlgen configuration to restrict a field to
# session authentication.
#
# It is meant to be combined with @authentication(required: PRESENT):
# @authentication enforces that the caller is authenticated, while @sessionOnly
# additionally rejects API key authentication (which carries an identity but no
# session). Use it for sensitive identity self-management (e.g. managing
# personal API keys).
#
# Usage in your schema.graphql:
# type Query {
# viewer: User @session(required: PRESENT)
# publicData: Data @session(required: OPTIONAL)
# signup(input: SignUpInput!): SignUpPayload @session(required: NONE)
# type Mutation {
# createPersonalAPIKey(input: CreatePersonalAPIKeyInput!): CreatePersonalAPIKeyPayload
# @authentication(required: PRESENT)
# @sessionOnly
# }
directive @session(required: SessionRequirement!) on FIELD_DEFINITION
enum SessionRequirement
@goModel(
model: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirement"
) {
"""
Requires an authenticated session or API key.
"""
PRESENT
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementPresent"
)
"""
Forbids authenticated access (e.g., for login/signup endpoints).
"""
NONE
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementNone"
)
"""
Allows both authenticated and unauthenticated access.
"""
OPTIONAL
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementOptional"
)
}
directive @sessionOnly on FIELD_DEFINITION

94
pkg/server/gqlutils/directives/session/session.go
View File

@@ -15,97 +15,23 @@
package session
import (
"bytes"
"context"
"fmt"
"io"
"strconv"
"github.com/99designs/gqlgen/graphql"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/gqlutils"
)
type SessionRequirement string
const (
SessionRequirementPresent SessionRequirement = "PRESENT"
SessionRequirementNone SessionRequirement = "NONE"
SessionRequirementOptional SessionRequirement = "OPTIONAL"
)
var AllSessionRequirement = []SessionRequirement{
SessionRequirementPresent,
SessionRequirementNone,
SessionRequirementOptional,
}
func (e SessionRequirement) IsValid() bool {
switch e {
case SessionRequirementPresent, SessionRequirementNone, SessionRequirementOptional:
return true
}
return false
}
func (e SessionRequirement) String() string {
return string(e)
}
func (e *SessionRequirement) UnmarshalGQL(v any) error {
str, ok := v.(string)
if !ok {
return fmt.Errorf("enums must be strings")
}
*e = SessionRequirement(str)
if !e.IsValid() {
return fmt.Errorf("%s is not a valid SessionRequirement", str)
}
return nil
}
func (e SessionRequirement) MarshalGQL(w io.Writer) {
_, _ = fmt.Fprint(w, strconv.Quote(e.String()))
}
func (e *SessionRequirement) UnmarshalJSON(b []byte) error {
s, err := strconv.Unquote(string(b))
if err != nil {
return err
}
return e.UnmarshalGQL(s)
}
func (e SessionRequirement) MarshalJSON() ([]byte, error) {
var buf bytes.Buffer
e.MarshalGQL(&buf)
return buf.Bytes(), nil
}
func Directive(ctx context.Context, obj any, next graphql.Resolver, required SessionRequirement) (any, error) {
identity := authn.IdentityFromContext(ctx)
switch required {
case SessionRequirementOptional:
case SessionRequirementPresent:
if identity == nil {
return nil, gqlutils.Unauthenticatedf(
ctx,
"authentication is required to access this resource",
)
}
case SessionRequirementNone:
if identity != nil {
return nil, gqlutils.AlreadyAuthenticatedf(
ctx,
"authentication not allowed for this resource/action",
)
}
// Directive enforces that the request carries a real session. It is meant to
// be combined with @authentication(required: PRESENT): @authentication handles
// the "must be authenticated" check, while @sessionOnly additionally rejects
// API key authentication, which also carries an identity but no session.
func Directive(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
if authn.SessionFromContext(ctx) == nil {
return nil, gqlutils.Forbiddenf(
ctx,
"this resource can only be accessed with session authentication, not API key authentication",
)
}
return next(ctx)