fix(graphql): return gin context error uniformly across all resolvers (#638)

* fix(graphql): return gin context error uniformly across all resolvers

All 50 GraphQL resolver files previously used `gc, _ :=
utils.GinContextFromContext(ctx)`, silently discarding the error and
relying on MetaFromGin's nil safety. This is fine at runtime but masks
programming errors and leaks an inconsistent contract: resolvers that
call ApplyToGin(gc, side) would panic on a nil gc, while read-only
resolvers would silently produce empty request metadata.

Apply the pattern already established in signup.go uniformly: check the
error from GinContextFromContext and return it immediately. The caller
gets the actual error ("could not retrieve gin.Context") instead of a
downstream auth failure or a nil-pointer panic.

* feat(graphql): add log, metric, and tests for gin context missing

For all 51 GraphQL resolvers the previous error branch was:
  return nil, err
Now it is:
  g.Log.Debug().Err(err).Msg("failed to get gin context")
  metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
  return nil, err

Changes:
- internal/metrics/metrics.go: add SecurityEventGinContextMissing constant
- internal/graphql/*.go (51 files): add structured debug log and security
  metric to the gin context error branch; add metrics import
- internal/integration_tests/gin_context_missing_test.go: 9 subtests
  covering resolvers with/without ApplyToGin and with/without auth,
  each called with context.Background() (no embedded gin.Context)

Not affected:
- HTTP handlers receive gin.Context directly as a function parameter
- gRPC handlers use transport.MetaFromGRPC which degrades gracefully
  when no gRPC metadata is present (already tested in
  internal/grpcsrv/transport/grpc_metadata_test.go TestMetaFromGRPC_NoMetadata)

* fix: route GORM logger to stderr and detach goroutines from request ctx

## GORM stdout → stderr (fixes smoke mcp_stdio)

GORM's default logger writes to os.Stdout. The MCP server speaks
JSON-RPC over stdio, so any stray stdout line (slow-query warnings,
AutoMigrate errors) corrupts the stream and produces
"unexpected end of JSON input" on the client.

PR #632 scoped logger.Discard to clearLegacyColumnUniqueness but the
global gorm.Config had no Logger set, leaving AutoMigrate and all other
GORM operations on the default stdout logger.

Fix: wire a stderr-backed GORM logger into ormConfig so every GORM
operation routes to stderr rather than stdout. Slow-query warnings and
errors remain visible; stdout stays clean for stdio transports.

## context.WithoutCancel in fire-and-forget goroutines

18 goroutines across 9 service files were capturing the request ctx and
using it for EventsProvider.RegisterEvent, StorageProvider.AddSession,
etc. If the request context is cancelled (client disconnect, upstream
timeout), those goroutines would return early without firing webhooks or
persisting sessions.

Fix: inject ctx := context.WithoutCancel(ctx) as the first statement in
every goroutine that uses the request ctx. This preserves any context
values (trace IDs, logger) while detaching from the cancellation signal,
so side effects complete independently of the request lifetime.

Goroutines that do not use ctx (MemoryStoreProvider calls, EmailProvider
calls whose signature takes no context) are left unchanged.

Author: lakhansamani

internal/graphql/add_email_template.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -13,7 +14,12 @@ import (
 //
 // Permissions: authorizer:admin
 func (g *graphqlProvider) AddEmailTemplate(ctx context.Context, params *model.AddEmailTemplateRequest) (*model.Response, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, _, err := g.adminService().AddEmailTemplate(ctx, service.MetaFromGin(gc), params)
 	return res, err
 }

internal/graphql/add_webhook.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -13,7 +14,12 @@ import (
 //
 // Permissions: authorizer:admin
 func (g *graphqlProvider) AddWebhook(ctx context.Context, params *model.AddWebhookRequest) (*model.Response, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, _, err := g.adminService().AddWebhook(ctx, service.MetaFromGin(gc), params)
 	return res, err
 }

internal/graphql/admin_login.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -13,7 +14,12 @@ import (
 //
 // Permissions: none
 func (g *graphqlProvider) AdminLogin(ctx context.Context, params *model.AdminLoginRequest) (*model.Response, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, side, err := g.adminService().AdminLogin(ctx, service.MetaFromGin(gc), params)
 	if err != nil {
 		return nil, err

internal/graphql/admin_logout.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -13,7 +14,12 @@ import (
 //
 // Permissions: authorizer:admin
 func (g *graphqlProvider) AdminLogout(ctx context.Context) (*model.Response, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, side, err := g.adminService().AdminLogout(ctx, service.MetaFromGin(gc))
 	if err != nil {
 		return nil, err

internal/graphql/admin_meta.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -13,7 +14,12 @@ import (
 //
 // Permissions: authorizer:admin
 func (g *graphqlProvider) AdminMeta(ctx context.Context) (*model.AdminMeta, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, _, err := g.adminService().AdminMeta(ctx, service.MetaFromGin(gc))
 	return res, err
 }

internal/graphql/admin_session.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -14,7 +15,12 @@ import (
 //
 // Permissions: authorizer:admin
 func (g *graphqlProvider) AdminSession(ctx context.Context) (*model.Response, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, side, err := g.adminService().AdminSession(ctx, service.MetaFromGin(gc))
 	if err != nil {
 		return nil, err

internal/graphql/audit_logs.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -13,7 +14,12 @@ import (
 //
 // Permissions: authorizer:admin
 func (g *graphqlProvider) AuditLogs(ctx context.Context, params *model.ListAuditLogRequest) (*model.AuditLogs, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, _, err := g.adminService().AuditLogs(ctx, service.MetaFromGin(gc), params)
 	return res, err
 }

internal/graphql/check_permissions.go

@@ -4,14 +4,20 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
 
 // CheckPermissions delegates to the transport-agnostic service layer, which
 // owns the subject trust gate and fail-closed semantics.
 func (g *graphqlProvider) CheckPermissions(ctx context.Context, params *model.CheckPermissionsInput) (*model.CheckPermissionsResponse, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, _, err := g.ServiceProvider.CheckPermissions(ctx, service.MetaFromGin(gc), params)
 	return res, err
 }

internal/graphql/deactivate_account.go

@@ -4,14 +4,20 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
 
 // DeactivateAccount delegates to the transport-agnostic service layer.
 // Permissions: authenticated user.
 func (g *graphqlProvider) DeactivateAccount(ctx context.Context) (*model.Response, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, side, err := g.ServiceProvider.DeactivateAccount(ctx, service.MetaFromGin(gc))
 	if err != nil {
 		return nil, err

internal/graphql/delete_email_template.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/metrics"
 	"github.com/authorizerdev/authorizer/internal/service"
 	"github.com/authorizerdev/authorizer/internal/utils"
 )
@@ -13,7 +14,12 @@ import (
 //
 // Permissions: authorizer:admin
 func (g *graphqlProvider) DeleteEmailTemplate(ctx context.Context, params *model.DeleteEmailTemplateRequest) (*model.Response, error) {
-	gc, _ := utils.GinContextFromContext(ctx)
+	gc, err := utils.GinContextFromContext(ctx)
+	if err != nil {
+		g.Log.Debug().Err(err).Msg("failed to get gin context")
+		metrics.RecordSecurityEvent(metrics.SecurityEventGinContextMissing, "graphql")
+		return nil, err
+	}
 	res, _, err := g.adminService().DeleteEmailTemplate(ctx, service.MetaFromGin(gc), params)
 	return res, err
 }