initial oidc support

src/core/server/graph/common/directives/auth.ts

@@ -0,0 +1,12 @@
+import { DirectiveResolverFn } from "graphql-tools";
+
+const auth: DirectiveResolverFn = (next, src, args, context) => {
+  return next().then(str => {
+    if (typeof str === "string") {
+      return str.toUpperCase();
+    }
+    return str;
+  });
+};
+
+export default auth;

src/core/server/graph/tenant/resolvers/auth_settings.ts

@@ -0,0 +1,14 @@
+import { GQLAuthSettingsTypeResolver } from "talk-server/graph/tenant/schema/__generated__/types";
+import { Auth, AuthIntegration } from "talk-server/models/tenant";
+
+const disabled: AuthIntegration = { enabled: false };
+
+const AuthSettings: GQLAuthSettingsTypeResolver<Auth> = {
+  local: auth => auth.local || disabled,
+  sso: auth => auth.sso || disabled,
+  oidc: auth => auth.oidc || disabled,
+  google: auth => auth.google || disabled,
+  facebook: auth => auth.facebook || disabled,
+};
+
+export default AuthSettings;

src/core/server/graph/tenant/resolvers/facebook_auth_integration.ts

@@ -0,0 +1,10 @@
+import { GQLFacebookAuthIntegrationTypeResolver } from "talk-server/graph/tenant/schema/__generated__/types";
+import { FacebookAuthIntegration } from "talk-server/models/tenant";
+
+const FacebookAuthIntegration: GQLFacebookAuthIntegrationTypeResolver<
+  FacebookAuthIntegration
+> = {
+  config: auth => auth,
+};
+
+export default FacebookAuthIntegration;

src/core/server/graph/tenant/resolvers/google_auth_integration.ts

@@ -0,0 +1,10 @@
+import { GQLGoogleAuthIntegrationTypeResolver } from "talk-server/graph/tenant/schema/__generated__/types";
+import { GoogleAuthIntegration } from "talk-server/models/tenant";
+
+const GoogleAuthIntegration: GQLGoogleAuthIntegrationTypeResolver<
+  GoogleAuthIntegration
+> = {
+  config: auth => auth,
+};
+
+export default GoogleAuthIntegration;

src/core/server/graph/tenant/resolvers/local_auth_integration.ts

@@ -0,0 +1,8 @@
+import { GQLLocalAuthIntegrationTypeResolver } from "talk-server/graph/tenant/schema/__generated__/types";
+import { LocalAuthIntegration } from "talk-server/models/tenant";
+
+const LocalAuthIntegration: GQLLocalAuthIntegrationTypeResolver<
+  LocalAuthIntegration
+> = {};
+
+export default LocalAuthIntegration;

src/core/server/graph/tenant/resolvers/oidc_auth_integration.ts

@@ -0,0 +1,10 @@
+import { GQLOIDCAuthIntegrationTypeResolver } from "talk-server/graph/tenant/schema/__generated__/types";
+import { OIDCAuthIntegration } from "talk-server/models/tenant";
+
+const OIDCAuthIntegration: GQLOIDCAuthIntegrationTypeResolver<
+  OIDCAuthIntegration
+> = {
+  config: auth => auth,
+};
+
+export default OIDCAuthIntegration;

src/core/server/graph/tenant/resolvers/sso_auth_integration.ts

@@ -0,0 +1,10 @@
+import { GQLSSOAuthIntegrationTypeResolver } from "talk-server/graph/tenant/schema/__generated__/types";
+import { SSOAuthIntegration } from "talk-server/models/tenant";
+
+const SSOAuthIntegration: GQLSSOAuthIntegrationTypeResolver<
+  SSOAuthIntegration
+> = {
+  config: auth => auth,
+};
+
+export default SSOAuthIntegration;

src/core/server/graph/tenant/schema/index.ts

@@ -1,8 +1,14 @@
-import { IResolvers } from "graphql-tools";
+import { attachDirectiveResolvers, IResolvers } from "graphql-tools";
 
+import auth from "talk-server/graph/common/directives/auth";
 import loadSchema from "talk-server/graph/common/schema";
 import resolvers from "talk-server/graph/tenant/resolvers";
 
 export default function getTenantSchema() {
-  return loadSchema("tenant", resolvers as IResolvers);
+  const schema = loadSchema("tenant", resolvers as IResolvers);
+
+  // Attach the directive resolvers.
+  attachDirectiveResolvers(schema, { auth });
+
+  return schema;
 }

src/core/server/graph/tenant/schema/schema.graphql

@@ -1,3 +1,9 @@
+################################################################################
+## Custom Directives
+################################################################################
+
+directive @auth(roles: [USER_ROLE!]!) on FIELD_DEFINITION
+
 ################################################################################
 ## Custom Scalar Types
 ################################################################################
@@ -45,7 +51,90 @@ type WordlistSettings {
   suspect: [String!]!
 }
 
-# Settings stores the global settings for a given installation.
+################################################################################
+## AuthSettings
+################################################################################
+
+##########################
+## LocalAuthIntegration
+##########################
+
+type LocalAuthIntegration {
+  enabled: Boolean!
+}
+
+##########################
+## SSOAuthIntegration
+##########################
+
+type SSOAuthIntegrationConfig {
+  key: String!
+}
+
+type SSOAuthIntegration {
+  enabled: Boolean!
+  config: SSOAuthIntegrationConfig @auth(roles: [ADMIN])
+}
+
+##########################
+## OIDCAuthIntegration
+##########################
+
+type OIDCAuthIntegrationConfig {
+  clientID: String!
+  clientSecret: String!
+  authorizationURL: String!
+  tokenURL: String!
+}
+
+type OIDCAuthIntegrationOptions {
+  name: String!
+}
+
+type OIDCAuthIntegration {
+  enabled: Boolean!
+  options: OIDCAuthIntegrationOptions
+  config: SSOAuthIntegrationConfig @auth(roles: [ADMIN])
+}
+
+##########################
+## GoogleAuthIntegration
+##########################
+
+type GoogleAuthIntegrationConfig {
+  clientID: String!
+  clientSecret: String!
+}
+
+type GoogleAuthIntegration {
+  enabled: Boolean!
+  config: GoogleAuthIntegrationConfig @auth(roles: [ADMIN])
+}
+
+##########################
+## FacebookAuthIntegration
+##########################
+
+type FacebookAuthIntegrationConfig {
+  clientID: String!
+  clientSecret: String!
+}
+
+type FacebookAuthIntegration {
+  enabled: Boolean!
+  config: FacebookAuthIntegrationConfig @auth(roles: [ADMIN])
+}
+
+"""
+AuthSettings contains all the settings related to authentication and authorization.
+"""
+type AuthSettings {
+  local: LocalAuthIntegration!
+  sso: SSOAuthIntegration!
+  oidc: OIDCAuthIntegration!
+  google: GoogleAuthIntegration!
+  facebook: FacebookAuthIntegration!
+}
 
 ################################################################################
 ## Settings
@@ -58,12 +147,12 @@ type Settings {
   """
   domain is the domain that is associated with this Tenant.
   """
-  domain: String!
+  domain: String @auth(roles: [ADMIN])
 
   """
   moderation is the moderation mode for all Asset's on the site.
   """
-  moderation: MODERATION_MODE!
+  moderation: MODERATION_MODE @auth(roles: [ADMIN])
 
   """
   Enables a requirement for email confirmation before a user can login.
@@ -100,7 +189,7 @@ type Settings {
   """
   premodLinksEnable will put all comments that contain links into premod.
   """
-  premodLinksEnable: Boolean!
+  premodLinksEnable: Boolean @auth(roles: [ADMIN])
 
   """
   autoCloseStream when true will auto close the stream when the `closeTimeout`
@@ -165,18 +254,29 @@ type Settings {
   """
   wordlist will return a given list of words.
   """
-  wordlist: WordlistSettings!
+  wordlist: WordlistSettings @auth(roles: [ADMIN])
 
   """
   domains will return a given list of whitelisted domains.
   """
-  domains: [String!]!
+  domains: [String!] @auth(roles: [ADMIN])
+
+  """
+  auth contains all the settings related to authentication and authorization.
+  """
+  auth: AuthSettings!
 }
 
 ################################################################################
 ## User
 ################################################################################
 
+enum USER_ROLE {
+  COMMENTER
+  MODERATOR
+  ADMIN
+}
+
 """
 User is someone that leaves Comments, and logs in.
 """
@@ -190,6 +290,11 @@ type User {
   username is the name of the User visible to other Users.
   """
   username: String!
+
+  """
+  role is the current role of the User.
+  """
+  role: USER_ROLE!
 }
 
 ################################################################################