[backend] Introduce @ff directive to restrict access to endpoints based on FFs

Author: fellowseb

opencti-platform/opencti-front/src/schema/relay.schema.graphql

@@ -8,6 +8,8 @@ directive @allowUnlicensedLTS on OBJECT | FIELD_DEFINITION
 
 directive @constraint(minLength: Int, maxLength: Int, startsWith: String, endsWith: String, notContains: String, pattern: String, format: String, min: Int, max: Int, exclusiveMin: Int, exclusiveMax: Int, multipleOf: Int) on INPUT_FIELD_DEFINITION
 
+directive @ff(flags: [String!]!, softFail: Boolean = false) on FIELD_DEFINITION
+
 """Controls the rate of traffic."""
 directive @rateLimit(
   """Number of occurrences allowed over duration."""

opencti-platform/opencti-graphql/config/schema/opencti.graphql

@@ -21,6 +21,7 @@ directive @constraint(
   exclusiveMax: Int
   multipleOf: Int
 ) on INPUT_FIELD_DEFINITION
+directive @ff(flags: [String!]!, softFail: Boolean = false) on FIELD_DEFINITION
 
 ### SCALAR
 

opencti-platform/opencti-graphql/src/generated/graphql.ts

@@ -40779,6 +40779,13 @@ export type ConstraintDirectiveArgs = {
 
 export type ConstraintDirectiveResolver<Result, Parent, ContextType = any, Args = ConstraintDirectiveArgs> = DirectiveResolverFn<Result, Parent, ContextType, Args>;
 
+export type FfDirectiveArgs = {
+  flags: Array<Scalars['String']['input']>;
+  softFail?: Maybe<Scalars['Boolean']['input']>;
+};
+
+export type FfDirectiveResolver<Result, Parent, ContextType = any, Args = FfDirectiveArgs> = DirectiveResolverFn<Result, Parent, ContextType, Args>;
+
 export type PublicDirectiveArgs = { };
 
 export type PublicDirectiveResolver<Result, Parent, ContextType = any, Args = PublicDirectiveArgs> = DirectiveResolverFn<Result, Parent, ContextType, Args>;
@@ -52732,5 +52739,6 @@ export type DirectiveResolvers<ContextType = any> = ResolversObject<{
   allowUnprotectedOTP?: AllowUnprotectedOtpDirectiveResolver<any, any, ContextType>;
   auth?: AuthDirectiveResolver<any, any, ContextType>;
   constraint?: ConstraintDirectiveResolver<any, any, ContextType>;
+  ff?: FfDirectiveResolver<any, any, ContextType>;
   public?: PublicDirectiveResolver<any, any, ContextType>;
 }>;

opencti-platform/opencti-graphql/src/graphql/featureFlagDirective.ts

@@ -0,0 +1,60 @@
+import { getDirective, MapperKind, mapSchema } from '@graphql-tools/utils';
+import { defaultFieldResolver } from 'graphql';
+import type { GraphQLFieldConfig, GraphQLSchema } from 'graphql';
+import { ForbiddenAccess } from '../config/errors';
+import type { AuthContext } from '../types/user';
+import { isFeatureEnabled } from '../config/conf';
+
+/**
+ * Arguments passed to the feature-flagging directive in GraphQL schema
+ * @example @ff(flags: ["SOME_FLAG", "SOME_OTHER_FLAG"], softFail: true)
+ */
+interface FeatureFlagDirectiveArgs {
+  /**
+   * Array of feature flags that allow access to the endpoint.
+   * If at least one flag is set for current user then access
+   * is granted. (i.e. an `or` operator is used between each one of them)
+   */
+  flags: string[];
+  /**
+   * If true indicates that a lack of enabled flag won't result
+   * in an error but in returning the value `null`.
+   * Can be useful for instance when querying very early in the app lifecycle
+   * before feature flags being available in the client.
+   * Defaults to `false`.
+   */
+  softFail: boolean;
+}
+
+const FF_DIRECTIVE = 'ff';
+
+export const makeFeatureFlagDirectiveTransformer = (): (schema: GraphQLSchema) => GraphQLSchema => {
+  return (schema: GraphQLSchema) => mapSchema(schema, {
+    [MapperKind.OBJECT_FIELD]: (fieldConfig: GraphQLFieldConfig<any, any>, _fieldName: string) => {
+      const directive = getDirective(schema, fieldConfig, FF_DIRECTIVE);
+      const ffDirective = directive?.[0] as FeatureFlagDirectiveArgs | undefined;
+
+      if (!ffDirective) {
+        return fieldConfig;
+      }
+
+      const { flags, softFail } = ffDirective;
+      if (!flags) {
+        return fieldConfig;
+      }
+
+      const { resolve = defaultFieldResolver } = fieldConfig;
+      fieldConfig.resolve = (source: any, args: any, context: AuthContext, info: any) => {
+        if (!flags.some((flag) => isFeatureEnabled(flag))) {
+          if (softFail) {
+            return null;
+          } else {
+            throw ForbiddenAccess();
+          }
+        }
+        return resolve(source, args, context, info);
+      };
+      return fieldConfig;
+    },
+  });
+};

opencti-platform/opencti-graphql/src/graphql/schema.js

@@ -72,6 +72,7 @@ import stixMetaObjectResolvers from '../resolvers/stixMetaObject';
 import filterKeysSchemaResolver from '../resolvers/filterKeysSchema';
 import basicObjectResolvers from '../resolvers/basicObject';
 import { FunctionalError } from '../config/errors';
+import { featureFlagDirectiveBuilder, getFeatureFlagDirectiveTransformer, makeFeatureFlagDirectiveTransformer } from './featureFlagDirective';
 
 const schemaTypeDefs = [globalTypeDefs];
 
@@ -280,6 +281,7 @@ const createSchema = () => {
   });
   schema = constraintDirectiveDocumentation()(schema);
   schema = rateLimitDirectiveTransformer(authDirectiveTransformer(schema));
+  schema = makeFeatureFlagDirectiveTransformer()(schema);
   return schema;
 };
 

opencti-platform/opencti-graphql/tests/01-unit/graphql/featureFlagDirective-test.ts

@@ -0,0 +1,86 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { graphql, parse } from 'graphql';
+import { makeExecutableSchema } from '@graphql-tools/schema';
+import { makeFeatureFlagDirectiveTransformer } from '../../../src/graphql/featureFlagDirective';
+import { isFeatureEnabled } from '../../../src/config/conf';
+
+vi.mock('../../../src/config/conf', () => ({
+  isFeatureEnabled: vi.fn(),
+}));
+
+describe('featureFlagDirective', () => {
+  afterEach(() => {
+    vi.resetAllMocks();
+  });
+
+  it('returns a Forbidden error when none of the flags are enabled', async () => {
+    const typeDefs = parse(`
+      directive @ff(flags: [String!]!, softFail: Boolean = false) on FIELD_DEFINITION
+      type Query {
+        flaggedFeature: String @ff(flags: ["SOME_FLAG", "SOME_OTHER_FLAG"])
+      }
+    `);
+    const resolvers = {
+      Query: {
+        flaggedFeature: () => 'experimental content',
+      },
+    };
+    vi.mocked(isFeatureEnabled).mockReturnValue(false);
+
+    let schema = makeExecutableSchema({ typeDefs, resolvers });
+    schema = makeFeatureFlagDirectiveTransformer()(schema);
+
+    const result = await graphql({ schema, source: '{ flaggedFeature }' });
+
+    expect(result.errors).not.toBeUndefined();
+    expect(result.errors?.[0].message).toMatch(/You are not allowed to do this/i);
+    expect(result.errors?.[0].extensions?.code).toMatch(/FORBIDDEN_ACCESS/i);
+  });
+
+  it('calls the resolver when one of the flags is enabled', async () => {
+    const typeDefs = parse(`
+      directive @ff(flags: [String!]!, softFail: Boolean = false) on FIELD_DEFINITION
+      type Query {
+        flaggedFeature: String @ff(flags: ["SOME_FLAG", "SOME_OTHER_FLAG"])
+      }
+    `);
+    const resolvers = {
+      Query: {
+        flaggedFeature: () => 'experimental content',
+      },
+    };
+    vi.mocked(isFeatureEnabled).mockImplementation((flag: string) => {
+      return flag === 'SOME_FLAG';
+    });
+
+    let schema = makeExecutableSchema({ typeDefs, resolvers });
+    schema = makeFeatureFlagDirectiveTransformer()(schema);
+
+    const result = await graphql({ schema, source: '{ flaggedFeature }' });
+
+    expect(result.data?.flaggedFeature).toBe('experimental content');
+  });
+
+  it('returns null when none of the flags are enabled and softFail is set', async () => {
+    const typeDefs = parse(`
+      directive @ff(flags: [String!]!, softFail: Boolean = false) on FIELD_DEFINITION
+      type Query {
+        flaggedFeature: String @ff(flags: ["SOME_FLAG"], softFail: true)
+      }
+    `);
+    const resolvers = {
+      Query: {
+        flaggedFeature: () => 'experimental content',
+      },
+    };
+    vi.mocked(isFeatureEnabled).mockReturnValue(false);
+
+    let schema = makeExecutableSchema({ typeDefs, resolvers });
+    schema = makeFeatureFlagDirectiveTransformer()(schema);
+
+    const result = await graphql({ schema, source: '{ flaggedFeature }' });
+
+    expect(result.errors).toBeUndefined();
+    expect(result.data?.flaggedFeature).toBeNull();
+  });
+});