rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Retrict some query and mutation to only session

Browse Source 
Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-02 17:43:00 -07:00
parent 9c4b6aff18
commit 383ea5a2d4
25 changed files with 268 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
pkg/server/gqlutils/directives/session/schema.graphql
View File

@@ -1,38 +1,18 @@
# Session directive for GraphQL APIs
# Include this schema in your gqlgen configuration to enable session-based access control.
# sessionOnly directive for GraphQL APIs
# Include this schema in your gqlgen configuration to restrict a field to
# session authentication.
#
# It is meant to be combined with @authentication(required: PRESENT):
# @authentication enforces that the caller is authenticated, while @sessionOnly
# additionally rejects API key authentication (which carries an identity but no
# session). Use it for sensitive identity self-management (e.g. managing
# personal API keys).
#
# Usage in your schema.graphql:
# type Query {
# viewer: User @session(required: PRESENT)
# publicData: Data @session(required: OPTIONAL)
# signup(input: SignUpInput!): SignUpPayload @session(required: NONE)
# type Mutation {
# createPersonalAPIKey(input: CreatePersonalAPIKeyInput!): CreatePersonalAPIKeyPayload
# @authentication(required: PRESENT)
# @sessionOnly
# }
directive @session(required: SessionRequirement!) on FIELD_DEFINITION
enum SessionRequirement
@goModel(
model: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirement"
) {
"""
Requires an authenticated session or API key.
"""
PRESENT
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementPresent"
)
"""
Forbids authenticated access (e.g., for login/signup endpoints).
"""
NONE
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementNone"
)
"""
Allows both authenticated and unauthenticated access.
"""
OPTIONAL
@goEnum(
value: "go.probo.inc/probo/pkg/server/gqlutils/directives/session.SessionRequirementOptional"
)
}
directive @sessionOnly on FIELD_DEFINITION