# sessionOnly directive for GraphQL APIs
# Include this schema in your gqlgen configuration to restrict a field to
# session authentication.
#
# It is meant to be combined with @authentication(required: PRESENT):
# @authentication enforces that the caller is authenticated, while @sessionOnly
# additionally rejects API key authentication (which carries an identity but no
# session). Use it for sensitive identity self-management (e.g. managing
# personal API keys).
#
# Usage in your schema.graphql:
#   type Mutation {
#     createPersonalAPIKey(input: CreatePersonalAPIKeyInput!): CreatePersonalAPIKeyPayload
#       @authentication(required: PRESENT)
#       @sessionOnly
#   }

directive @sessionOnly on FIELD_DEFINITION