Add GraphQL customer authorization utilities (issue #761)

[octoaide]

This PR implements a small helper module to centralize customer-scoping and authorization logic used by the GraphQL layer (graphql::auth), addressing issue #761.

Closes #761

Summary of changes:

• Add new module src/graphql/auth.rs providing customer-scoping utilities for GraphQL handlers.

  • Public helpers:
    • is_admin(customer_ids: &Option<Vec>) -> bool
    • is_member(customer_ids: &Option<Vec>, customer_id: u32) -> bool
    • membership_intersection(customer_ids, items) -> Vec
    • filter_by_membership(customer_ids, iter, f) -> Vec
    • filter_by_customer_id(customer_ids, iter, f) -> Vec
    • unauthorized_error() -> async_graphql::Error
  • Admin semantics: customer_ids == None means administrator (full access).
  • Utilities support single-customer and multi-customer item filtering; admins bypass filters.
  • Returns a canonical GraphQL unauthorized error for use by handlers.

• Export auth module from src/graphql.rs so it is available as crate::graphql::auth.

• Add unit tests covering admin behavior, membership checks, intersection logic, iterator filtering, and unauthorized error.

• Update CHANGELOG.md with an entry describing the new utilities.

Why this change:

• Centralizes customer authorization concerns used across GraphQL resolvers.
• Standardizes admin semantics and error handling to simplify downstream domain PRs and reduce duplication.

Files changed (high level):

• src/graphql/auth.rs (new)
• src/graphql.rs (export of auth module)
• CHANGELOG.md (entry)

Notes:

• Customer IDs use u32 to match existing codebase conventions.
• The module exposes small, well-documented helpers designed for easy consumption by GraphQL resolvers and future domain PRs.

If you want any naming or API adjustments (e.g., using a different integer type for customer IDs), I can update the implementation accordingly.

[codecov]

Codecov Report

❌ Patch coverage is 87.14653% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.13%. Comparing base (f2d6adc) to head (a196615).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
src/graphql.rs	79.42%	50 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #767      +/-   ##
==========================================
+ Coverage   75.91%   76.13%   +0.21%     
==========================================
  Files          72       73       +1     
  Lines       19935    20324     +389     
==========================================
+ Hits        15134    15473     +339     
- Misses       4801     4851      +50     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sophie-cluml]

I can see that PR contains common building block functions for upcoming tasks and I think it is highly beneficial to have robust testing that covers not just success paths, but also dangerous, edge, and boundary cases. I suggest adding the following two specific test cases, and I would like to ask you to also check if there are any other cases that should be covered.

• process_load_edges_filtered : Verify that has_next/has_previous flags work correctly when all data is filtered out by the predicate, resulting in an empty list.
• users_customers: It seems like we need test code for this.

[danbi2990]

Applied the suggested adjustment.

[sophie-cluml]

Suggested change

	Ok(user.customer_ids.clone())
	Ok(user.customer_ids)

[danbi2990]

Updated accordingly.

[octoaide]

@sehkone — Friendly ping: PR #767 (Add GraphQL customer authorization utilities) is approved (final approval 2026-01-18), all CI/checks are passing, and the PR is not a draft. It has been ready for merge for more than 7 days but shows mergeable_state: blocked (branch protection rules preventing merge). Could you please take a look and either merge it or advise what action is needed (e.g., adjust branch-protection requirements, grant merge rights, or request a specific additional review)? If you prefer, I can rebase or make any tiny adjustments required to satisfy branch-protection rules — please let me know the preferred next step. Thanks!

[sophie-cluml]

@danbi2990 Could you rebase upon main please?

[danbi2990]

Rebase completed.