Graphql auth

[kevinhughes27]

part of #750

I can test locally that logging in shows additional schema fields and incognito shows less.

Notes - MutationOperation is useless because of differences in how context variables (user and tournament) are used in existing operations. I am going to remove MutationOperation and call operations manually in resolve.

I added basic smoke screen tests here to capture api auth in tests. Testing all the logic via graphql can wait until I remove the operations.

[kevinhughes27]

I would love to not have to re-define this for each mutation that requires auth. I have 2 ideas neither of which I fully understand how to implement:

1. Push this down to the mutation itself and use something like

GraphQL::Relay::Mutation.accepts_definitions ( auth_required: ... )

2. Somehow have an auth_require do block around all the mutations in this file

[kevinhughes27]

I'm debating what value the schema filter adds. Its cool to not even expose parts of the schema the user is not authorised for but it comes with a few issues:

• The actual auth code is never ran when the schema is filtered since a not in the schema error fires first. This makes actual auth more like a backup but its kinda sketchy that it never runs. This also leaves gaps for auth code not being added causing bugs in the future
• On a related note I can't control the error message so my nice messages about wrong tournament or please signup get trumped by the schema error