Retrict some query and mutation to only session

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/gqlutils/directives/session/schema.graphql

@@ -1,38 +1,18 @@
-# Session directive for GraphQL APIs
-# Include this schema in your gqlgen configuration to enable session-based access control.
+# sessionOnly directive for GraphQL APIs
+# Include this schema in your gqlgen configuration to restrict a field to
+# session authentication.
+#
+# It is meant to be combined with @authentication(required: PRESENT):
+# @authentication enforces that the caller is authenticated, while @sessionOnly
+# additionally rejects API key authentication (which carries an identity but no
+# session). Use it for sensitive identity self-management (e.g. managing
+# personal API keys).
 #
 # Usage in your schema.graphql:
-#   type Query {
-#     viewer: User @session(required: PRESENT)
-#     publicData: Data @session(required: OPTIONAL)
-#     signup(input: SignUpInput!): SignUpPayload @session(required: NONE)
+#   type Mutation {
+#     createPersonalAPIKey(input: CreatePersonalAPIKeyInput!): CreatePersonalAPIKeyPayload
+#       @authentication(required: PRESENT)
+#       @sessionOnly
 #   }
 
-directive @session(required: SessionRequirement!) on FIELD_DEFINITION
-
-enum SessionRequirement
-  @goModel(
-    model: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirement"
-  ) {
-  """
-  Requires an authenticated session or API key.
-  """
-  PRESENT
-    @goEnum(
-      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementPresent"
-    )
-  """
-  Forbids authenticated access (e.g., for login/signup endpoints).
-  """
-  NONE
-    @goEnum(
-      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementNone"
-    )
-  """
-  Allows both authenticated and unauthenticated access.
-  """
-  OPTIONAL
-    @goEnum(
-      value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementOptional"
-    )
-}
+directive @sessionOnly on FIELD_DEFINITION

pkg/server/gqlutils/directives/session/session.go

@@ -15,97 +15,23 @@
 package session
 
 import (
-	"bytes"
 	"context"
-	"fmt"
-	"io"
-	"strconv"
 
 	"github.com/99designs/gqlgen/graphql"
 	"go.probo.inc/probo/pkg/server/api/authn"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )
 
-type SessionRequirement string
-
-const (
-	SessionRequirementPresent  SessionRequirement = "PRESENT"
-	SessionRequirementNone     SessionRequirement = "NONE"
-	SessionRequirementOptional SessionRequirement = "OPTIONAL"
-)
-
-var AllSessionRequirement = []SessionRequirement{
-	SessionRequirementPresent,
-	SessionRequirementNone,
-	SessionRequirementOptional,
-}
-
-func (e SessionRequirement) IsValid() bool {
-	switch e {
-	case SessionRequirementPresent, SessionRequirementNone, SessionRequirementOptional:
-		return true
-	}
-
-	return false
-}
-
-func (e SessionRequirement) String() string {
-	return string(e)
-}
-
-func (e *SessionRequirement) UnmarshalGQL(v any) error {
-	str, ok := v.(string)
-	if !ok {
-		return fmt.Errorf("enums must be strings")
-	}
-
-	*e = SessionRequirement(str)
-	if !e.IsValid() {
-		return fmt.Errorf("%s is not a valid SessionRequirement", str)
-	}
-
-	return nil
-}
-
-func (e SessionRequirement) MarshalGQL(w io.Writer) {
-	_, _ = fmt.Fprint(w, strconv.Quote(e.String()))
-}
-
-func (e *SessionRequirement) UnmarshalJSON(b []byte) error {
-	s, err := strconv.Unquote(string(b))
-	if err != nil {
-		return err
-	}
-
-	return e.UnmarshalGQL(s)
-}
-
-func (e SessionRequirement) MarshalJSON() ([]byte, error) {
-	var buf bytes.Buffer
-	e.MarshalGQL(&buf)
-
-	return buf.Bytes(), nil
-}
-
-func Directive(ctx context.Context, obj any, next graphql.Resolver, required SessionRequirement) (any, error) {
-	identity := authn.IdentityFromContext(ctx)
-
-	switch required {
-	case SessionRequirementOptional:
-	case SessionRequirementPresent:
-		if identity == nil {
-			return nil, gqlutils.Unauthenticatedf(
-				ctx,
-				"authentication is required to access this resource",
-			)
-		}
-	case SessionRequirementNone:
-		if identity != nil {
-			return nil, gqlutils.AlreadyAuthenticatedf(
-				ctx,
-				"authentication not allowed for this resource/action",
-			)
-		}
+// Directive enforces that the request carries a real session. It is meant to
+// be combined with @authentication(required: PRESENT): @authentication handles
+// the "must be authenticated" check, while @sessionOnly additionally rejects
+// API key authentication, which also carries an identity but no session.
+func Directive(ctx context.Context, obj any, next graphql.Resolver) (any, error) {
+	if authn.SessionFromContext(ctx) == nil {
+		return nil, gqlutils.Forbiddenf(
+			ctx,
+			"this resource can only be accessed with session authentication, not API key authentication",
+		)
 	}
 
 	return next(ctx)