Introduce authorizations with Rajska

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/graphql/schema/auth_application.ex

@@ -7,15 +7,17 @@ defmodule Mobilizon.GraphQL.Schema.AuthApplicationType do
 
   @desc "An application"
   object :auth_application do
+    meta(:authorize, :user)
     field(:id, :id)
     field(:name, :string)
     field(:client_id, :string)
-    field(:scopes, :string)
+    field(:scope, :string)
     field(:website, :string)
   end
 
   @desc "An application"
   object :auth_application_token do
+    meta(:authorize, :user)
     field(:id, :id)
     field(:inserted_at, :string)
     field(:last_used_at, :string)
@@ -24,11 +26,15 @@ defmodule Mobilizon.GraphQL.Schema.AuthApplicationType do
 
   @desc "The informations returned after authorization"
   object :application_code_and_state do
+    meta(:authorize, :user)
     field(:code, :string)
     field(:state, :string)
+    field(:client_id, :string)
+    field(:scope, :string)
   end
 
   object :application_device_activation do
+    meta(:authorize, :user)
     field(:id, :id)
     field(:application, :auth_application)
     field(:scope, :string)
@@ -38,6 +44,14 @@ defmodule Mobilizon.GraphQL.Schema.AuthApplicationType do
     @desc "Get an application"
     field :auth_application, :auth_application do
       arg(:client_id, non_null(:string), description: "The application's client_id")
+
+      middleware(Rajska.QueryAuthorization,
+        permit: :user,
+        scope: Mobilizon.Applications.Application,
+        rule: :forbid_app_access,
+        args: %{client_id: :client_id}
+      )
+
       resolve(&Application.get_application/3)
     end
   end
@@ -51,18 +65,33 @@ defmodule Mobilizon.GraphQL.Schema.AuthApplicationType do
         description: "The URI to redirect to with the code and state"
       )
 
-      arg(:scope, :string, description: "The scope for the authorization")
+      arg(:scope, non_null(:string), description: "The scope for the authorization")
 
       arg(:state, :string,
         description: "A state parameter to check that the request wasn't altered"
       )
 
+      middleware(Rajska.QueryAuthorization,
+        permit: :user,
+        scope: Mobilizon.Applications.Application,
+        rule: :forbid_app_access,
+        args: %{client_id: :client_id}
+      )
+
       resolve(&Application.authorize/3)
     end
 
     @desc "Revoke an authorized application"
     field :revoke_application_token, :deleted_object do
       arg(:app_token_id, non_null(:string), description: "The application token's ID")
+
+      middleware(Rajska.QueryAuthorization,
+        permit: :user,
+        scope: Mobilizon.Applications.ApplicationToken,
+        rule: :forbid_app_access,
+        args: %{id: :app_token_id}
+      )
+
       resolve(&Application.revoke_application_token/3)
     end
 
@@ -72,13 +101,30 @@ defmodule Mobilizon.GraphQL.Schema.AuthApplicationType do
         description: "The code provided by the application entered by the user"
       )
 
+      middleware(Rajska.QueryAuthorization,
+        permit: :user,
+        scope: Mobilizon.Applications.ApplicationDeviceActivation,
+        rule: :forbid_app_access,
+        args: %{id: :user_code}
+      )
+
       resolve(&Application.activate_device/3)
     end
 
     @desc "Activate an user device"
     field :authorize_device_application, :auth_application do
       arg(:client_id, non_null(:string), description: "The application's client_id")
-      arg(:scope, :string, description: "The scope for the authorization")
+
+      arg(:user_code, non_null(:string),
+        description: "The code provided by the application entered by the user"
+      )
+
+      middleware(Rajska.QueryAuthorization,
+        permit: :user,
+        scope: Mobilizon.Applications.ApplicationDeviceActivation,
+        rule: :forbid_app_access,
+        args: %{id: :client_id}
+      )
 
       resolve(&Application.authorize_device_application/3)
     end