Introduce authorizations with Rajska

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/graphql/schema/media.ex

@@ -8,6 +8,7 @@ defmodule Mobilizon.GraphQL.Schema.MediaType do
 
   @desc "A media"
   object :media do
+    meta(:authorize, :all)
     field(:id, :id, description: "The media's ID")
     field(:alt, :string, description: "The media's alternative text")
     field(:name, :string, description: "The media's name")
@@ -21,6 +22,7 @@ defmodule Mobilizon.GraphQL.Schema.MediaType do
   A paginated list of medias
   """
   object :paginated_media_list do
+    meta(:authorize, :all)
     field(:elements, list_of(:media), description: "The list of medias")
     field(:total, :integer, description: "The total number of medias in the list")
   end
@@ -29,6 +31,7 @@ defmodule Mobilizon.GraphQL.Schema.MediaType do
   Some metadata associated with a media
   """
   object :media_metadata do
+    meta(:authorize, :all)
     field(:width, :integer, description: "The media width (if a picture)")
     field(:height, :integer, description: "The media width (if a height)")
     field(:blurhash, :string, description: "The media blurhash (if a picture")
@@ -54,6 +57,7 @@ defmodule Mobilizon.GraphQL.Schema.MediaType do
     @desc "Get a media"
     field :media, :media do
       arg(:id, non_null(:id), description: "The media ID")
+      middleware(Rajska.QueryAuthorization, permit: :all)
       resolve(&Media.media/3)
     end
   end
@@ -64,6 +68,15 @@ defmodule Mobilizon.GraphQL.Schema.MediaType do
       arg(:name, non_null(:string), description: "The media's name")
       arg(:alt, :string, description: "The media's alternative text")
       arg(:file, non_null(:upload), description: "The media file")
+      arg(:actor_id, :id, description: "The actor that uploads the media")
+
+      middleware(Rajska.QueryAuthorization,
+        permit: :user,
+        scope: Mobilizon.Medias.Media,
+        rule: :"write:media:upload",
+        args: %{}
+      )
+
       resolve(&Media.upload_media/3)
     end
 
@@ -72,6 +85,13 @@ defmodule Mobilizon.GraphQL.Schema.MediaType do
     """
     field :remove_media, :deleted_object do
       arg(:id, non_null(:id), description: "The media's ID")
+
+      middleware(Rajska.QueryAuthorization,
+        permit: :user,
+        scope: Mobilizon.Medias.Media,
+        rule: :"write:media:remove"
+      )
+
       resolve(&Media.remove_media/3)
     end
   end