[DO NOT MERGE][feat] Add access token scopes authorization based on graphql directives

[kopancek]

Description

This only works on token based authorization, when using non-internal tokens. Existing functionality was kept backwards compatible on this POC, so if you have a token with "user:all" or "site-admin:sudo" everything works like before. Similarly session based auth still works the same.

Added a directive @authz(scopes: ["some_scope"]) which controls scopes that are required when calling the graphql API with a token based authentication. When this directive is present on a field, query, mutation or type, it is required that the token has scopes that are listed. The beauty of this approach is, that we can add different scopes to different queries/fields/mutations and single source of truth is our graphql schema.

Video

POC_.access.token.scopes.authorization.-.29.September.2022.mp4

Out of scope for POC

• making anything here nice or production ready
• unit tests
• failing authorization on queries/mutations/fields without the directive
• adding scopes to all needed graphql entities
• UI changes to create tokens with more scopes
• making backwards incompatible changes
• authorizing internal API access

Test plan

Tested locally.

To test locally, you need to modify go.mod to point to your own local fork of graph-gophers/graphql-go#446 It is also needed to apply the patch suggested in this comment: https://github.com/graph-gophers/graphql-go/pull/446/files#r914374506

To create a token with different scopes, create a normal token as you would usually by going to Settings -> Access tokens. You need to modify the scopes directly in the database (yikes!). Search the schema.graphql file for @authz directive scope definitions that are required with these changes.

You then need to use the token directly with curl or similar.

When using the token without proper scopes, you should see graphql errors instead of data.

[sg-e2e-regression-test-bob]

Bundle size report 📦

Initial size	Total size	Async size	Modules
0.00% (0.00 kb)	0.00% (0.00 kb)	0.00% (0.00 kb)	0.00% (0)

Look at the Statoscope report for a full comparison between the commits 62e366c and 7836dc2 or learn more.

Open explanation

• Initial size is the size of the initial bundle (the one that is loaded when you open the page)
• Total size is the size of the initial bundle + all the async loaded chunks
• Async size is the size of all the async loaded chunks
• Modules is the number of modules in the initial bundle

[mrnugget]