How can we protect parts of the API behind the network firewall

[tristan-orourke]

Because we're using Sign in Canada, a user does not lose their account if they leave government. Our main tool to ensure they are still a government user is that they still have access to the government network. We can easily but some endpoints behind the firewall, like /admin, but everything important happens via the API.

How do we ensure that only current government employees can take privileged actions on the API?

Some ideas:

1. We have two schemas: a basic schema, and an Admin schema which extends the first schema. Then Admin schema has its own endpoint is behind the firewall.
2. We duplicate the entire schema twice. Some endpoints or queries are protected by a directive/middleware which causes them to fail unless on the admin endpoint.
3. Force elevated accounts to 'validate' themselves periodically by hitting a special endpoint on the admin network. The API remains public, but policy validation somehow only works for recently validated accounts.

[petertgiles]

The problem I see with (1) is that it forces us into duplicating schema objects to support different permissions, which is an approach we are consciously moving away from, I think.

(3) sounds interesting. Maybe add a login endpoint that is only available on the VPN and if you use that you are validated?
Could we do it invisibly somehow? Maybe as part of the regular login handshake ask the client to touch an endpoint only available on the VPN?

At my last job, we used the hire date and termination date from HR to expire accounts. Is there an endpoint that, given a PRI, could tell us if the employee is active?

[tristan-orourke]

Lighthouse now links to this document of best-practice recommendations for GraphQL, which includes this recommendation for dealing with different levels of access: https://graphql-rules.com/rules/authorization-schema-diffing

[petertgiles]

This sounds super interesting. I especially like this benefit:

Eliminates the possibility of graph traversal from unauthorized nodes.

I have no idea how this would be implemented though. 😅

[tristan-orourke]

Resolved in #9866 and #10030 !