Retrict some query and mutation to only session

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/gqlutils/directives/authentication/authentication.go

@@ -0,0 +1,112 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package authentication
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+
+	"github.com/99designs/gqlgen/graphql"
+	"go.probo.inc/probo/pkg/server/api/authn"
+	"go.probo.inc/probo/pkg/server/gqlutils"
+)
+
+type AuthenticationRequirement string
+
+const (
+	AuthenticationRequirementPresent  AuthenticationRequirement = "PRESENT"
+	AuthenticationRequirementNone     AuthenticationRequirement = "NONE"
+	AuthenticationRequirementOptional AuthenticationRequirement = "OPTIONAL"
+)
+
+var AllAuthenticationRequirement = []AuthenticationRequirement{
+	AuthenticationRequirementPresent,
+	AuthenticationRequirementNone,
+	AuthenticationRequirementOptional,
+}
+
+func (e AuthenticationRequirement) IsValid() bool {
+	switch e {
+	case AuthenticationRequirementPresent, AuthenticationRequirementNone, AuthenticationRequirementOptional:
+		return true
+	}
+
+	return false
+}
+
+func (e AuthenticationRequirement) String() string {
+	return string(e)
+}
+
+func (e *AuthenticationRequirement) UnmarshalGQL(v any) error {
+	str, ok := v.(string)
+	if !ok {
+		return fmt.Errorf("enums must be strings")
+	}
+
+	*e = AuthenticationRequirement(str)
+	if !e.IsValid() {
+		return fmt.Errorf("%s is not a valid AuthenticationRequirement", str)
+	}
+
+	return nil
+}
+
+func (e AuthenticationRequirement) MarshalGQL(w io.Writer) {
+	_, _ = fmt.Fprint(w, strconv.Quote(e.String()))
+}
+
+func (e *AuthenticationRequirement) UnmarshalJSON(b []byte) error {
+	s, err := strconv.Unquote(string(b))
+	if err != nil {
+		return err
+	}
+
+	return e.UnmarshalGQL(s)
+}
+
+func (e AuthenticationRequirement) MarshalJSON() ([]byte, error) {
+	var buf bytes.Buffer
+	e.MarshalGQL(&buf)
+
+	return buf.Bytes(), nil
+}
+
+func Directive(ctx context.Context, obj any, next graphql.Resolver, required AuthenticationRequirement) (any, error) {
+	identity := authn.IdentityFromContext(ctx)
+
+	switch required {
+	case AuthenticationRequirementOptional:
+	case AuthenticationRequirementPresent:
+		if identity == nil {
+			return nil, gqlutils.Unauthenticatedf(
+				ctx,
+				"authentication is required to access this resource",
+			)
+		}
+	case AuthenticationRequirementNone:
+		if identity != nil {
+			return nil, gqlutils.AlreadyAuthenticatedf(
+				ctx,
+				"authentication not allowed for this resource/action",
+			)
+		}
+	}
+
+	return next(ctx)
+}

pkg/server/gqlutils/directives/authentication/schema.graphql

@@ -0,0 +1,39 @@
+# Authentication directive for GraphQL APIs
+# Include this schema in your gqlgen configuration to enable identity-based
+# access control (session OR API key).
+#
+# Usage in your schema.graphql:
+#   type Query {
+#     viewer: User @authentication(required: PRESENT)
+#     publicData: Data @authentication(required: OPTIONAL)
+#     signup(input: SignUpInput!): SignUpPayload @authentication(required: NONE)
+#   }
+
+directive @authentication(required: AuthenticationRequirement!) on FIELD_DEFINITION
+
+enum AuthenticationRequirement
+  @goModel(
+    model: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirement"
+  ) {
+  """
+  Requires an authenticated identity (session or API key).
+  """
+  PRESENT
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementPresent"
+    )
+  """
+  Forbids authenticated access (e.g., for login/signup endpoints).
+  """
+  NONE
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementNone"
+    )
+  """
+  Allows both authenticated and unauthenticated access.
+  """
+  OPTIONAL
+    @goEnum(
+      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/authentication.AuthenticationRequirementOptional"
+    )
+}