Introduce authorizations with Rajska

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/graphql/schema/todos/todo.ex

@@ -9,6 +9,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoType do
 
   @desc "A todo"
   object :todo do
+    meta(:authorize, :user)
     field(:id, :id, description: "The todo's ID")
     field(:title, :string, description: "The todo's title")
     field(:status, :boolean, description: "The todo's status")
@@ -30,6 +31,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoType do
   A paginated list of todos
   """
   object :paginated_todo_list do
+    meta(:authorize, :user)
     field(:elements, list_of(:todo), description: "A list of todos")
     field(:total, :integer, description: "The total number of todos in the list")
   end
@@ -38,6 +40,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoType do
     @desc "Get a todo"
     field :todo, :todo do
       arg(:id, non_null(:id), description: "The todo ID")
+      middleware(Rajska.QueryAuthorization, permit: :user, scope: false)
       resolve(&TodoResolver.get_todo/3)
     end
   end
@@ -50,6 +53,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoType do
       arg(:status, :boolean, description: "The todo status")
       arg(:due_date, :datetime, description: "The todo due date")
       arg(:assigned_to_id, :id, description: "The actor this todo is assigned to")
+      middleware(Rajska.QueryAuthorization, permit: :user, scope: false)
 
       resolve(&TodoResolver.create_todo/3)
     end
@@ -62,7 +66,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoType do
       arg(:status, :boolean, description: "The new todo status")
       arg(:due_date, :datetime, description: "The new todo due date")
       arg(:assigned_to_id, :id, description: "The new id of the actor this todo is assigned to")
-
+      middleware(Rajska.QueryAuthorization, permit: :user, scope: false)
       resolve(&TodoResolver.update_todo/3)
     end
 

lib/graphql/schema/todos/todo_list.ex

@@ -9,6 +9,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoListType do
 
   @desc "A todo list"
   object :todo_list do
+    meta(:authorize, :user)
     field(:id, :id, description: "The todo list's ID")
     field(:title, :string, description: "The todo list's title")
 
@@ -37,6 +38,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoListType do
   A paginated list of todo-lists
   """
   object :paginated_todo_list_list do
+    meta(:authorize, :user)
     field(:elements, list_of(:todo_list), description: "A list of todo lists")
     field(:total, :integer, description: "The total number of todo lists in the list")
   end
@@ -45,6 +47,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoListType do
     @desc "Get a todo list"
     field :todo_list, :todo_list do
       arg(:id, non_null(:id), description: "The todo-list ID")
+      middleware(Rajska.QueryAuthorization, permit: :user, scope: false)
       resolve(&Todos.get_todo_list/3)
     end
   end
@@ -54,6 +57,7 @@ defmodule Mobilizon.GraphQL.Schema.Todos.TodoListType do
     field :create_todo_list, :todo_list do
       arg(:title, non_null(:string), description: "The todo list title")
       arg(:group_id, non_null(:id), description: "The group ID")
+      middleware(Rajska.QueryAuthorization, permit: :user, scope: false)
       resolve(&Todos.create_todo_list/3)
     end
   end