From 590c9c42037ae7b0defe83668219662845dc3550 Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Tue, 24 Aug 2021 14:47:22 +0200
Subject: [PATCH] server: add @private directive glue code

---
 server/directives.go | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/server/directives.go b/server/directives.go
index 8aa2399f08810cb5e8ca127add0fe127adc4a4cc..4eb296c897976a9c209eb4d7e5801698fa0fa0bc 100644
--- a/server/directives.go
+++ b/server/directives.go
@@ -19,6 +19,23 @@ func Internal(ctx context.Context, obj interface{},
 	return next(ctx)
 }
 
+func Private(ctx context.Context, obj interface{},
+	next graphql.Resolver) (interface{}, error) {
+
+	user := auth.ForContext(ctx)
+	switch user.AuthMethod {
+	case auth.AUTH_INTERNAL:
+		return next(ctx)
+	case auth.AUTH_OAUTH2:
+		if user.BearerToken.ClientID != "" {
+			return nil, fmt.Errorf("Private auth access denied")
+		}
+		return next(ctx)
+	}
+
+	return nil, fmt.Errorf("Private auth access denied")
+}
+
 func Access(ctx context.Context, obj interface{}, next graphql.Resolver,
 	scope string, kind string) (interface{}, error) {
 	authctx := auth.ForContext(ctx)