feat: allow to conditionally block mutation via expressions

[StarpTech]

Motivation and Context

This pull request introduces the capability to conditionally block mutations, subscriptions, and non-persisted operations. Instead of relying on YAML configuration alone, we have implemented support for dynamic expressions that are evaluated at runtime. Users can leverage request headers, URL parameters, query parameters, and authentication context (such as claims and scopes) to define the condition when operations are blocked. If no condition is provided all operations are blocked.

Example Configuration

Block by a header condition

security:
  block_mutations:
    enabled: true
    condition: |
      // Case insensitive
      request.header.Get('x-block-mutation') == 'yes'

Block by a scope condition

security:
  block_mutations:
    enabled: true
    condition: |
      'write' in request.auth.scopes

The expression parser and runtime are powered by expr-lang, a widely used library in the Go ecosystem. We chose expr for its elegant DSL and robust error reporting.

During router bootstrap, the system will validate that the expression are valid and returns the expected type (a boolean for conditions). If the expression evaluates to an incorrect type, the process will fail with a detailed error message.

This step forward, will also lay the foundation for a more dynamic approach in applying configuration or extracting values at runtime.

Warning

As part of the preparations for Cosmo V1, targeted for release in Q1 2025, this pull request introduces essential changes to enhance long-term stability and maintainability. While we strive to minimize breaking changes, they are sometimes necessary to lay the foundation for a more robust and scalable system. This update includes non-backward compatible modifications, specifically impacting the configuration of operation blocking mechanisms.

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• Documentation has been updated on https://github.com/wundergraph/cosmo-docs.
• I have read the Contributors Guide.

[github-actions]

Router image scan passed

✅ No security vulnerabilities found in image:

ghcr.io/wundergraph/cosmo/router:sha-cb32dac23cb444d0b45784e4170a5a54c0d0e94d

[Noroth]

Let me know about my last comment otherwise LGTM

[Noroth]

LGTM