Use graphql directive for auth handling (#1671)

2026-07-04 19:34:35 -05:00 · 2025-09-29 17:24:19 +02:00
parent 5e48b05270
commit 5c79672d84
35 changed files with 297 additions and 555 deletions
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/BackupMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/BackupMutation.kt
@@ -1,21 +1,17 @@
 package suwayomi.tachidesk.graphql.mutations

-import graphql.schema.DataFetchingEnvironment
 import io.javalin.http.UploadedFile
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.withTimeout
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.server.TemporaryFileStorage
-import suwayomi.tachidesk.graphql.server.getAttribute
 import suwayomi.tachidesk.graphql.types.BackupRestoreStatus
 import suwayomi.tachidesk.graphql.types.toStatus
 import suwayomi.tachidesk.manga.impl.backup.BackupFlags
 import suwayomi.tachidesk.manga.impl.backup.proto.ProtoBackupExport
 import suwayomi.tachidesk.manga.impl.backup.proto.ProtoBackupImport
 import suwayomi.tachidesk.manga.impl.backup.proto.models.Backup
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import java.util.concurrent.CompletableFuture
 import kotlin.time.Duration.Companion.seconds

@@ -31,11 +27,8 @@ class BackupMutation {
        val status: BackupRestoreStatus?,
    )

-    fun restoreBackup(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: RestoreBackupInput,
-    ): CompletableFuture<RestoreBackupPayload> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun restoreBackup(input: RestoreBackupInput): CompletableFuture<RestoreBackupPayload> {
        val (clientMutationId, backup) = input

        return future {
@@ -66,11 +59,8 @@ class BackupMutation {
        val url: String,
    )

-    fun createBackup(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: CreateBackupInput? = null,
-    ): CreateBackupPayload {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun createBackup(input: CreateBackupInput? = null): CreateBackupPayload {
        val filename = Backup.getFilename()

        val backup =
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/CategoryMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/CategoryMutation.kt
@@ -1,7 +1,6 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import org.jetbrains.exposed.sql.SqlExpressionBuilder.eq
 import org.jetbrains.exposed.sql.SqlExpressionBuilder.inList
 import org.jetbrains.exposed.sql.SqlExpressionBuilder.minus
@@ -13,7 +12,7 @@ import org.jetbrains.exposed.sql.selectAll
 import org.jetbrains.exposed.sql.transactions.transaction
 import org.jetbrains.exposed.sql.update
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.CategoryMetaType
 import suwayomi.tachidesk.graphql.types.CategoryType
 import suwayomi.tachidesk.graphql.types.MangaType
@@ -25,9 +24,6 @@ import suwayomi.tachidesk.manga.model.table.CategoryMangaTable
 import suwayomi.tachidesk.manga.model.table.CategoryMetaTable
 import suwayomi.tachidesk.manga.model.table.CategoryTable
 import suwayomi.tachidesk.manga.model.table.MangaTable
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser

 class CategoryMutation {
    data class SetCategoryMetaInput(
@@ -40,12 +36,9 @@ class CategoryMutation {
        val meta: CategoryMetaType,
    )

-    fun setCategoryMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: SetCategoryMetaInput,
-    ): DataFetcherResult<SetCategoryMetaPayload?> =
+    @RequireAuth
+    fun setCategoryMeta(input: SetCategoryMetaInput): DataFetcherResult<SetCategoryMetaPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, meta) = input

            Category.modifyMeta(meta.categoryId, meta.key, meta.value)
@@ -65,12 +58,9 @@ class CategoryMutation {
        val category: CategoryType,
    )

-    fun deleteCategoryMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteCategoryMetaInput,
-    ): DataFetcherResult<DeleteCategoryMetaPayload?> =
+    @RequireAuth
+    fun deleteCategoryMeta(input: DeleteCategoryMetaInput): DataFetcherResult<DeleteCategoryMetaPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, categoryId, key) = input

            val (meta, category) =
@@ -163,12 +153,9 @@ class CategoryMutation {
        }
    }

-    fun updateCategory(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateCategoryInput,
-    ): DataFetcherResult<UpdateCategoryPayload?> =
+    @RequireAuth
+    fun updateCategory(input: UpdateCategoryInput): DataFetcherResult<UpdateCategoryPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, id, patch) = input

            updateCategories(listOf(id), patch)
@@ -184,12 +171,9 @@ class CategoryMutation {
            )
        }

-    fun updateCategories(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateCategoriesInput,
-    ): DataFetcherResult<UpdateCategoriesPayload?> =
+    @RequireAuth
+    fun updateCategories(input: UpdateCategoriesInput): DataFetcherResult<UpdateCategoriesPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, ids, patch) = input

            updateCategories(ids, patch)
@@ -216,12 +200,9 @@ class CategoryMutation {
        val position: Int,
    )

-    fun updateCategoryOrder(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateCategoryOrderInput,
-    ): DataFetcherResult<UpdateCategoryOrderPayload?> =
+    @RequireAuth
+    fun updateCategoryOrder(input: UpdateCategoryOrderInput): DataFetcherResult<UpdateCategoryOrderPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, categoryId, position) = input
            require(position > 0) {
                "'order' must not be <= 0"
@@ -278,12 +259,9 @@ class CategoryMutation {
        val category: CategoryType,
    )

-    fun createCategory(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: CreateCategoryInput,
-    ): DataFetcherResult<CreateCategoryPayload?> =
+    @RequireAuth
+    fun createCategory(input: CreateCategoryInput): DataFetcherResult<CreateCategoryPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, name, order, default, includeInUpdate, includeInDownload) = input
            transaction {
                require(CategoryTable.selectAll().where { CategoryTable.name eq input.name }.isEmpty()) {
@@ -341,12 +319,9 @@ class CategoryMutation {
        val mangas: List<MangaType>,
    )

-    fun deleteCategory(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteCategoryInput,
-    ): DataFetcherResult<DeleteCategoryPayload?> {
+    @RequireAuth
+    fun deleteCategory(input: DeleteCategoryInput): DataFetcherResult<DeleteCategoryPayload?> {
        return asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, categoryId) = input
            if (categoryId == 0) { // Don't delete default category
                return@asDataFetcherResult DeleteCategoryPayload(
@@ -434,12 +409,9 @@ class CategoryMutation {
        }
    }

-    fun updateMangaCategories(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateMangaCategoriesInput,
-    ): DataFetcherResult<UpdateMangaCategoriesPayload?> =
+    @RequireAuth
+    fun updateMangaCategories(input: UpdateMangaCategoriesInput): DataFetcherResult<UpdateMangaCategoriesPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, id, patch) = input

            updateMangas(listOf(id), patch)
@@ -455,12 +427,9 @@ class CategoryMutation {
            )
        }

-    fun updateMangasCategories(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateMangasCategoriesInput,
-    ): DataFetcherResult<UpdateMangasCategoriesPayload?> =
+    @RequireAuth
+    fun updateMangasCategories(input: UpdateMangasCategoriesInput): DataFetcherResult<UpdateMangasCategoriesPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, ids, patch) = input

            updateMangas(ids, patch)
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/ChapterMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/ChapterMutation.kt
@@ -1,7 +1,6 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import kotlinx.coroutines.GlobalScope
 import kotlinx.coroutines.launch
 import org.jetbrains.exposed.dao.id.EntityID
@@ -13,7 +12,7 @@ import org.jetbrains.exposed.sql.statements.BatchUpdateStatement
 import org.jetbrains.exposed.sql.transactions.transaction
 import org.jetbrains.exposed.sql.update
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.ChapterMetaType
 import suwayomi.tachidesk.graphql.types.ChapterType
 import suwayomi.tachidesk.graphql.types.SyncConflictInfoType
@@ -22,10 +21,7 @@ import suwayomi.tachidesk.manga.impl.chapter.getChapterDownloadReadyById
 import suwayomi.tachidesk.manga.impl.sync.KoreaderSyncService
 import suwayomi.tachidesk.manga.model.table.ChapterMetaTable
 import suwayomi.tachidesk.manga.model.table.ChapterTable
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import java.net.URLEncoder
 import java.time.Instant
 import java.util.concurrent.CompletableFuture
@@ -117,12 +113,9 @@ class ChapterMutation {
        }
    }

-    fun updateChapter(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateChapterInput,
-    ): DataFetcherResult<UpdateChapterPayload?> =
+    @RequireAuth
+    fun updateChapter(input: UpdateChapterInput): DataFetcherResult<UpdateChapterPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, id, patch) = input

            updateChapters(listOf(id), patch)
@@ -138,12 +131,9 @@ class ChapterMutation {
            )
        }

-    fun updateChapters(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateChaptersInput,
-    ): DataFetcherResult<UpdateChaptersPayload?> =
+    @RequireAuth
+    fun updateChapters(input: UpdateChaptersInput): DataFetcherResult<UpdateChaptersPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, ids, patch) = input

            updateChapters(ids, patch)
@@ -169,11 +159,8 @@ class ChapterMutation {
        val chapters: List<ChapterType>,
    )

-    fun fetchChapters(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: FetchChaptersInput,
-    ): CompletableFuture<DataFetcherResult<FetchChaptersPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun fetchChapters(input: FetchChaptersInput): CompletableFuture<DataFetcherResult<FetchChaptersPayload?>> {
        val (clientMutationId, mangaId) = input

        return future {
@@ -207,12 +194,9 @@ class ChapterMutation {
        val meta: ChapterMetaType,
    )

-    fun setChapterMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: SetChapterMetaInput,
-    ): DataFetcherResult<SetChapterMetaPayload?> =
+    @RequireAuth
+    fun setChapterMeta(input: SetChapterMetaInput): DataFetcherResult<SetChapterMetaPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, meta) = input

            Chapter.modifyChapterMeta(meta.chapterId, meta.key, meta.value)
@@ -232,12 +216,9 @@ class ChapterMutation {
        val chapter: ChapterType,
    )

-    fun deleteChapterMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteChapterMetaInput,
-    ): DataFetcherResult<DeleteChapterMetaPayload?> =
+    @RequireAuth
+    fun deleteChapterMeta(input: DeleteChapterMetaInput): DataFetcherResult<DeleteChapterMetaPayload?> =
        asDataFetcherResult {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val (clientMutationId, chapterId, key) = input

            val (meta, chapter) =
@@ -285,11 +266,8 @@ class ChapterMutation {
        val syncConflict: SyncConflictInfoType?,
    )

-    fun fetchChapterPages(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: FetchChapterPagesInput,
-    ): CompletableFuture<DataFetcherResult<FetchChapterPagesPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun fetchChapterPages(input: FetchChapterPagesInput): CompletableFuture<DataFetcherResult<FetchChapterPagesPayload?>> {
        val (clientMutationId, chapterId) = input
        val paramsMap = input.toParams()

--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/DownloadMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/DownloadMutation.kt
@@ -1,13 +1,12 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.withTimeout
 import org.jetbrains.exposed.sql.selectAll
 import org.jetbrains.exposed.sql.transactions.transaction
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.ChapterType
 import suwayomi.tachidesk.graphql.types.DownloadStatus
 import suwayomi.tachidesk.manga.impl.Chapter
@@ -15,9 +14,7 @@ import suwayomi.tachidesk.manga.impl.download.DownloadManager
 import suwayomi.tachidesk.manga.impl.download.model.DownloadUpdateType.DEQUEUED
 import suwayomi.tachidesk.manga.impl.download.model.Status
 import suwayomi.tachidesk.manga.model.table.ChapterTable
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.user.requireUser
 import java.util.concurrent.CompletableFuture
 import kotlin.time.Duration.Companion.seconds

@@ -32,11 +29,8 @@ class DownloadMutation {
        val chapters: List<ChapterType>,
    )

-    fun deleteDownloadedChapters(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteDownloadedChaptersInput,
-    ): DataFetcherResult<DeleteDownloadedChaptersPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun deleteDownloadedChapters(input: DeleteDownloadedChaptersInput): DataFetcherResult<DeleteDownloadedChaptersPayload?> {
        val (clientMutationId, chapters) = input

        return asDataFetcherResult {
@@ -65,11 +59,8 @@ class DownloadMutation {
        val chapters: ChapterType,
    )

-    fun deleteDownloadedChapter(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteDownloadedChapterInput,
-    ): DataFetcherResult<DeleteDownloadedChapterPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun deleteDownloadedChapter(input: DeleteDownloadedChapterInput): DataFetcherResult<DeleteDownloadedChapterPayload?> {
        val (clientMutationId, chapter) = input

        return asDataFetcherResult {
@@ -95,11 +86,10 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

+    @RequireAuth
    fun enqueueChapterDownloads(
-        dataFetchingEnvironment: DataFetchingEnvironment,
        input: EnqueueChapterDownloadsInput,
    ): CompletableFuture<DataFetcherResult<EnqueueChapterDownloadsPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
        val (clientMutationId, chapters) = input

        return future {
@@ -132,11 +122,8 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

-    fun enqueueChapterDownload(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: EnqueueChapterDownloadInput,
-    ): CompletableFuture<DataFetcherResult<EnqueueChapterDownloadPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun enqueueChapterDownload(input: EnqueueChapterDownloadInput): CompletableFuture<DataFetcherResult<EnqueueChapterDownloadPayload?>> {
        val (clientMutationId, chapter) = input

        return future {
@@ -168,11 +155,10 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

+    @RequireAuth
    fun dequeueChapterDownloads(
-        dataFetchingEnvironment: DataFetchingEnvironment,
        input: DequeueChapterDownloadsInput,
    ): CompletableFuture<DataFetcherResult<DequeueChapterDownloadsPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
        val (clientMutationId, chapters) = input

        return future {
@@ -207,11 +193,8 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

-    fun dequeueChapterDownload(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DequeueChapterDownloadInput,
-    ): CompletableFuture<DataFetcherResult<DequeueChapterDownloadPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun dequeueChapterDownload(input: DequeueChapterDownloadInput): CompletableFuture<DataFetcherResult<DequeueChapterDownloadPayload?>> {
        val (clientMutationId, chapter) = input

        return future {
@@ -245,13 +228,10 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

-    fun startDownloader(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: StartDownloaderInput,
-    ): CompletableFuture<DataFetcherResult<StartDownloaderPayload?>> =
+    @RequireAuth
+    fun startDownloader(input: StartDownloaderInput): CompletableFuture<DataFetcherResult<StartDownloaderPayload?>> =
        future {
            asDataFetcherResult {
-                dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
                DownloadManager.start()

                StartDownloaderPayload(
@@ -277,13 +257,10 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

-    fun stopDownloader(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: StopDownloaderInput,
-    ): CompletableFuture<DataFetcherResult<StopDownloaderPayload?>> =
+    @RequireAuth
+    fun stopDownloader(input: StopDownloaderInput): CompletableFuture<DataFetcherResult<StopDownloaderPayload?>> =
        future {
            asDataFetcherResult {
-                dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
                DownloadManager.stop()

                StopDownloaderPayload(
@@ -309,13 +286,10 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

-    fun clearDownloader(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: ClearDownloaderInput,
-    ): CompletableFuture<DataFetcherResult<ClearDownloaderPayload?>> =
+    @RequireAuth
+    fun clearDownloader(input: ClearDownloaderInput): CompletableFuture<DataFetcherResult<ClearDownloaderPayload?>> =
        future {
            asDataFetcherResult {
-                dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
                DownloadManager.clear()

                ClearDownloaderPayload(
@@ -343,11 +317,8 @@ class DownloadMutation {
        val downloadStatus: DownloadStatus,
    )

-    fun reorderChapterDownload(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: ReorderChapterDownloadInput,
-    ): CompletableFuture<DataFetcherResult<ReorderChapterDownloadPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun reorderChapterDownload(input: ReorderChapterDownloadInput): CompletableFuture<DataFetcherResult<ReorderChapterDownloadPayload?>> {
        val (clientMutationId, chapter, to) = input

        return future {
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/ExtensionMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/ExtensionMutation.kt
@@ -2,20 +2,16 @@ package suwayomi.tachidesk.graphql.mutations

 import eu.kanade.tachiyomi.source.local.LocalSource
 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import io.javalin.http.UploadedFile
 import org.jetbrains.exposed.sql.selectAll
 import org.jetbrains.exposed.sql.transactions.transaction
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.ExtensionType
 import suwayomi.tachidesk.manga.impl.extension.Extension
 import suwayomi.tachidesk.manga.impl.extension.ExtensionsList
 import suwayomi.tachidesk.manga.model.table.ExtensionTable
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import java.util.concurrent.CompletableFuture

 class ExtensionMutation {
@@ -78,11 +74,8 @@ class ExtensionMutation {
        }
    }

-    fun updateExtension(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateExtensionInput,
-    ): CompletableFuture<DataFetcherResult<UpdateExtensionPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun updateExtension(input: UpdateExtensionInput): CompletableFuture<DataFetcherResult<UpdateExtensionPayload?>> {
        val (clientMutationId, id, patch) = input

        return future {
@@ -106,11 +99,8 @@ class ExtensionMutation {
        }
    }

-    fun updateExtensions(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateExtensionsInput,
-    ): CompletableFuture<DataFetcherResult<UpdateExtensionsPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun updateExtensions(input: UpdateExtensionsInput): CompletableFuture<DataFetcherResult<UpdateExtensionsPayload?>> {
        val (clientMutationId, ids, patch) = input

        return future {
@@ -142,11 +132,8 @@ class ExtensionMutation {
        val extensions: List<ExtensionType>,
    )

-    fun fetchExtensions(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: FetchExtensionsInput,
-    ): CompletableFuture<DataFetcherResult<FetchExtensionsPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun fetchExtensions(input: FetchExtensionsInput): CompletableFuture<DataFetcherResult<FetchExtensionsPayload?>> {
        val (clientMutationId) = input

        return future {
@@ -179,11 +166,10 @@ class ExtensionMutation {
        val extension: ExtensionType,
    )

+    @RequireAuth
    fun installExternalExtension(
-        dataFetchingEnvironment: DataFetchingEnvironment,
        input: InstallExternalExtensionInput,
    ): CompletableFuture<DataFetcherResult<InstallExternalExtensionPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
        val (clientMutationId, extensionFile) = input

        return future {
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/ImageMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/ImageMutation.kt
@@ -1,12 +1,8 @@
 package suwayomi.tachidesk.graphql.mutations

-import graphql.schema.DataFetchingEnvironment
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.manga.impl.util.storage.ImageResponse
 import suwayomi.tachidesk.server.ApplicationDirs
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import uy.kohesive.injekt.injectLazy

 private val applicationDirs: ApplicationDirs by injectLazy()
@@ -26,11 +22,8 @@ class ImageMutation {
        val cachedPages: Boolean?,
    )

-    fun clearCachedImages(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: ClearCachedImagesInput,
-    ): ClearCachedImagesPayload {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun clearCachedImages(input: ClearCachedImagesInput): ClearCachedImagesPayload {
        val (clientMutationId, downloadedThumbnails, cachedThumbnails, cachedPages) = input

        val downloadedThumbnailsResult =
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/InfoMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/InfoMutation.kt
@@ -1,20 +1,16 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.withTimeout
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.UpdateState.DOWNLOADING
 import suwayomi.tachidesk.graphql.types.UpdateState.ERROR
 import suwayomi.tachidesk.graphql.types.UpdateState.IDLE
 import suwayomi.tachidesk.graphql.types.WebUIFlavor
 import suwayomi.tachidesk.graphql.types.WebUIUpdateStatus
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import suwayomi.tachidesk.server.util.WebInterfaceManager
 import java.util.concurrent.CompletableFuture
 import kotlin.time.Duration.Companion.seconds
@@ -29,13 +25,10 @@ class InfoMutation {
        val updateStatus: WebUIUpdateStatus,
    )

-    fun updateWebUI(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: WebUIUpdateInput,
-    ): CompletableFuture<DataFetcherResult<WebUIUpdatePayload?>> {
+    @RequireAuth
+    fun updateWebUI(input: WebUIUpdateInput): CompletableFuture<DataFetcherResult<WebUIUpdatePayload?>> {
        return future {
            asDataFetcherResult {
-                dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
                withTimeout(30.seconds) {
                    if (WebInterfaceManager.status.value.state === DOWNLOADING) {
                        return@withTimeout WebUIUpdatePayload(input.clientMutationId, WebInterfaceManager.status.value)
@@ -68,10 +61,10 @@ class InfoMutation {
        }
    }

-    fun resetWebUIUpdateStatus(dataFetchingEnvironment: DataFetchingEnvironment): CompletableFuture<DataFetcherResult<WebUIUpdateStatus?>> =
+    @RequireAuth
+    fun resetWebUIUpdateStatus(): CompletableFuture<DataFetcherResult<WebUIUpdateStatus?>> =
        future {
            asDataFetcherResult {
-                dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
                withTimeout(30.seconds) {
                    val isUpdateFinished = WebInterfaceManager.status.value.state != DOWNLOADING
                    if (!isUpdateFinished) {
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/KoreaderSyncMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/KoreaderSyncMutation.kt
@@ -1,12 +1,11 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import org.jetbrains.exposed.sql.selectAll
 import org.jetbrains.exposed.sql.transactions.transaction
 import org.jetbrains.exposed.sql.update
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.ChapterType
 import suwayomi.tachidesk.graphql.types.KoSyncConnectPayload
 import suwayomi.tachidesk.graphql.types.LogoutKoSyncAccountPayload
@@ -14,9 +13,7 @@ import suwayomi.tachidesk.graphql.types.SettingsType
 import suwayomi.tachidesk.graphql.types.SyncConflictInfoType
 import suwayomi.tachidesk.manga.impl.sync.KoreaderSyncService
 import suwayomi.tachidesk.manga.model.table.ChapterTable
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.user.requireUser
 import java.util.concurrent.CompletableFuture

 class KoreaderSyncMutation {
@@ -26,12 +23,9 @@ class KoreaderSyncMutation {
        val password: String,
    )

-    fun connectKoSyncAccount(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: ConnectKoSyncAccountInput,
-    ): CompletableFuture<KoSyncConnectPayload> =
+    @RequireAuth
+    fun connectKoSyncAccount(input: ConnectKoSyncAccountInput): CompletableFuture<KoSyncConnectPayload> =
        future {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            val result = KoreaderSyncService.connect(input.username, input.password)

            KoSyncConnectPayload(
@@ -47,12 +41,9 @@ class KoreaderSyncMutation {
        val clientMutationId: String? = null,
    )

-    fun logoutKoSyncAccount(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: LogoutKoSyncAccountInput,
-    ): CompletableFuture<LogoutKoSyncAccountPayload> =
+    @RequireAuth
+    fun logoutKoSyncAccount(input: LogoutKoSyncAccountInput): CompletableFuture<LogoutKoSyncAccountPayload> =
        future {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            KoreaderSyncService.logout()
            LogoutKoSyncAccountPayload(
                clientMutationId = input.clientMutationId,
@@ -72,14 +63,10 @@ class KoreaderSyncMutation {
        val chapter: ChapterType?,
    )

-    fun pushKoSyncProgress(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: PushKoSyncProgressInput,
-    ): CompletableFuture<DataFetcherResult<PushKoSyncProgressPayload?>> =
+    @RequireAuth
+    fun pushKoSyncProgress(input: PushKoSyncProgressInput): CompletableFuture<DataFetcherResult<PushKoSyncProgressPayload?>> =
        future {
            asDataFetcherResult {
-                dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
-
                KoreaderSyncService.pushProgress(input.chapterId)

                val chapter =
@@ -110,14 +97,10 @@ class KoreaderSyncMutation {
        val syncConflict: SyncConflictInfoType?,
    )

-    fun pullKoSyncProgress(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: PullKoSyncProgressInput,
-    ): CompletableFuture<DataFetcherResult<PullKoSyncProgressPayload?>> =
+    @RequireAuth
+    fun pullKoSyncProgress(input: PullKoSyncProgressInput): CompletableFuture<DataFetcherResult<PullKoSyncProgressPayload?>> =
        future {
            asDataFetcherResult {
-                dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
-
                val syncResult = KoreaderSyncService.checkAndPullProgress(input.chapterId)
                var syncConflictInfo: SyncConflictInfoType? = null

--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/MangaMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/MangaMutation.kt
@@ -1,7 +1,6 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import org.jetbrains.exposed.sql.SqlExpressionBuilder.eq
 import org.jetbrains.exposed.sql.and
 import org.jetbrains.exposed.sql.deleteWhere
@@ -9,7 +8,7 @@ import org.jetbrains.exposed.sql.selectAll
 import org.jetbrains.exposed.sql.transactions.transaction
 import org.jetbrains.exposed.sql.update
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.MangaMetaType
 import suwayomi.tachidesk.graphql.types.MangaType
 import suwayomi.tachidesk.manga.impl.Library
@@ -18,10 +17,7 @@ import suwayomi.tachidesk.manga.impl.update.IUpdater
 import suwayomi.tachidesk.manga.model.table.MangaMetaTable
 import suwayomi.tachidesk.manga.model.table.MangaTable
 import suwayomi.tachidesk.manga.model.table.toDataClass
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import uy.kohesive.injekt.injectLazy
 import java.time.Instant
 import java.util.concurrent.CompletableFuture
@@ -95,11 +91,8 @@ class MangaMutation {
        }
    }

-    fun updateManga(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateMangaInput,
-    ): CompletableFuture<DataFetcherResult<UpdateMangaPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun updateManga(input: UpdateMangaInput): CompletableFuture<DataFetcherResult<UpdateMangaPayload?>> {
        val (clientMutationId, id, patch) = input

        return future {
@@ -119,11 +112,8 @@ class MangaMutation {
        }
    }

-    fun updateMangas(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateMangasInput,
-    ): CompletableFuture<DataFetcherResult<UpdateMangasPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun updateMangas(input: UpdateMangasInput): CompletableFuture<DataFetcherResult<UpdateMangasPayload?>> {
        val (clientMutationId, ids, patch) = input

        return future {
@@ -153,11 +143,8 @@ class MangaMutation {
        val manga: MangaType,
    )

-    fun fetchManga(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: FetchMangaInput,
-    ): CompletableFuture<DataFetcherResult<FetchMangaPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun fetchManga(input: FetchMangaInput): CompletableFuture<DataFetcherResult<FetchMangaPayload?>> {
        val (clientMutationId, id) = input

        return future {
@@ -186,11 +173,8 @@ class MangaMutation {
        val meta: MangaMetaType,
    )

-    fun setMangaMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: SetMangaMetaInput,
-    ): DataFetcherResult<SetMangaMetaPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun setMangaMeta(input: SetMangaMetaInput): DataFetcherResult<SetMangaMetaPayload?> {
        val (clientMutationId, meta) = input

        return asDataFetcherResult {
@@ -212,11 +196,8 @@ class MangaMutation {
        val manga: MangaType,
    )

-    fun deleteMangaMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteMangaMetaInput,
-    ): DataFetcherResult<DeleteMangaMetaPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun deleteMangaMeta(input: DeleteMangaMetaInput): DataFetcherResult<DeleteMangaMetaPayload?> {
        val (clientMutationId, mangaId, key) = input

        return asDataFetcherResult {
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/MetaMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/MetaMutation.kt
@@ -1,7 +1,6 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import org.jetbrains.exposed.sql.SqlExpressionBuilder.eq
 import org.jetbrains.exposed.sql.deleteWhere
 import org.jetbrains.exposed.sql.selectAll
@@ -9,11 +8,8 @@ import org.jetbrains.exposed.sql.transactions.transaction
 import suwayomi.tachidesk.global.impl.GlobalMeta
 import suwayomi.tachidesk.global.model.table.GlobalMetaTable
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.GlobalMetaType
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser

 class MetaMutation {
    data class SetGlobalMetaInput(
@@ -26,11 +22,8 @@ class MetaMutation {
        val meta: GlobalMetaType,
    )

-    fun setGlobalMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: SetGlobalMetaInput,
-    ): DataFetcherResult<SetGlobalMetaPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun setGlobalMeta(input: SetGlobalMetaInput): DataFetcherResult<SetGlobalMetaPayload?> {
        val (clientMutationId, meta) = input

        return asDataFetcherResult {
@@ -50,11 +43,8 @@ class MetaMutation {
        val meta: GlobalMetaType?,
    )

-    fun deleteGlobalMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteGlobalMetaInput,
-    ): DataFetcherResult<DeleteGlobalMetaPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun deleteGlobalMeta(input: DeleteGlobalMetaInput): DataFetcherResult<DeleteGlobalMetaPayload?> {
        val (clientMutationId, key) = input

        return asDataFetcherResult {
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/SettingsMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/SettingsMutation.kt
@@ -1,17 +1,14 @@
 package suwayomi.tachidesk.graphql.mutations

 import com.expediagroup.graphql.generator.annotations.GraphQLIgnore
-import graphql.schema.DataFetchingEnvironment
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.PartialSettingsType
 import suwayomi.tachidesk.graphql.types.Settings
 import suwayomi.tachidesk.graphql.types.SettingsType
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.SERVER_CONFIG_MODULE_NAME
 import suwayomi.tachidesk.server.ServerConfig
 import suwayomi.tachidesk.server.settings.SettingsUpdater
 import suwayomi.tachidesk.server.settings.SettingsValidator
-import suwayomi.tachidesk.server.user.requireUser
 import xyz.nulldev.ts.config.GlobalConfigManager

 class SettingsMutation {
@@ -35,11 +32,8 @@ class SettingsMutation {
        SettingsUpdater.updateAll(settings)
    }

-    fun setSettings(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: SetSettingsInput,
-    ): SetSettingsPayload {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun setSettings(input: SetSettingsInput): SetSettingsPayload {
        val (clientMutationId, settings) = input

        updateSettings(settings)
@@ -56,11 +50,8 @@ class SettingsMutation {
        val settings: SettingsType,
    )

-    fun resetSettings(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: ResetSettingsInput,
-    ): ResetSettingsPayload {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun resetSettings(input: ResetSettingsInput): ResetSettingsPayload {
        val (clientMutationId) = input

        GlobalConfigManager.resetUserConfig()
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/SourceMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/SourceMutation.kt
@@ -6,14 +6,13 @@ import androidx.preference.ListPreference
 import androidx.preference.MultiSelectListPreference
 import androidx.preference.SwitchPreferenceCompat
 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import org.jetbrains.exposed.sql.SqlExpressionBuilder.eq
 import org.jetbrains.exposed.sql.and
 import org.jetbrains.exposed.sql.deleteWhere
 import org.jetbrains.exposed.sql.selectAll
 import org.jetbrains.exposed.sql.transactions.transaction
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.FilterChange
 import suwayomi.tachidesk.graphql.types.MangaType
 import suwayomi.tachidesk.graphql.types.Preference
@@ -27,10 +26,7 @@ import suwayomi.tachidesk.manga.impl.util.source.GetCatalogueSource
 import suwayomi.tachidesk.manga.model.table.MangaTable
 import suwayomi.tachidesk.manga.model.table.SourceMetaTable
 import suwayomi.tachidesk.manga.model.table.SourceTable
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import java.util.concurrent.CompletableFuture

 class SourceMutation {
@@ -44,11 +40,8 @@ class SourceMutation {
        val meta: SourceMetaType,
    )

-    fun setSourceMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: SetSourceMetaInput,
-    ): DataFetcherResult<SetSourceMetaPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun setSourceMeta(input: SetSourceMetaInput): DataFetcherResult<SetSourceMetaPayload?> {
        val (clientMutationId, meta) = input

        return asDataFetcherResult {
@@ -70,11 +63,8 @@ class SourceMutation {
        val source: SourceType?,
    )

-    fun deleteSourceMeta(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: DeleteSourceMetaInput,
-    ): DataFetcherResult<DeleteSourceMetaPayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun deleteSourceMeta(input: DeleteSourceMetaInput): DataFetcherResult<DeleteSourceMetaPayload?> {
        val (clientMutationId, sourceId, key) = input

        return asDataFetcherResult {
@@ -129,11 +119,8 @@ class SourceMutation {
        val hasNextPage: Boolean,
    )

-    fun fetchSourceManga(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: FetchSourceMangaInput,
-    ): CompletableFuture<DataFetcherResult<FetchSourceMangaPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun fetchSourceManga(input: FetchSourceMangaInput): CompletableFuture<DataFetcherResult<FetchSourceMangaPayload?>> {
        val (clientMutationId, sourceId, type, page, query, filters) = input

        return future {
@@ -199,11 +186,8 @@ class SourceMutation {
        val source: SourceType,
    )

-    fun updateSourcePreference(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateSourcePreferenceInput,
-    ): DataFetcherResult<UpdateSourcePreferencePayload?> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun updateSourcePreference(input: UpdateSourcePreferenceInput): DataFetcherResult<UpdateSourcePreferencePayload?> {
        val (clientMutationId, sourceId, change) = input

        return asDataFetcherResult {
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/TrackMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/TrackMutation.kt
@@ -3,21 +3,17 @@ package suwayomi.tachidesk.graphql.mutations
 import com.expediagroup.graphql.generator.annotations.GraphQLDeprecated
 import com.expediagroup.graphql.generator.annotations.GraphQLDescription
 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import org.jetbrains.exposed.sql.and
 import org.jetbrains.exposed.sql.selectAll
 import org.jetbrains.exposed.sql.transactions.transaction
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.TrackRecordType
 import suwayomi.tachidesk.graphql.types.TrackerType
 import suwayomi.tachidesk.manga.impl.track.Track
 import suwayomi.tachidesk.manga.impl.track.tracker.TrackerManager
 import suwayomi.tachidesk.manga.model.table.TrackRecordTable
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import java.util.concurrent.CompletableFuture

 class TrackMutation {
@@ -33,11 +29,8 @@ class TrackMutation {
        val tracker: TrackerType,
    )

-    fun loginTrackerOAuth(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: LoginTrackerOAuthInput,
-    ): CompletableFuture<LoginTrackerOAuthPayload> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun loginTrackerOAuth(input: LoginTrackerOAuthInput): CompletableFuture<LoginTrackerOAuthPayload> {
        val tracker =
            requireNotNull(TrackerManager.getTracker(input.trackerId)) {
                "Could not find tracker"
@@ -66,11 +59,8 @@ class TrackMutation {
        val tracker: TrackerType,
    )

-    fun loginTrackerCredentials(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: LoginTrackerCredentialsInput,
-    ): CompletableFuture<LoginTrackerCredentialsPayload> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun loginTrackerCredentials(input: LoginTrackerCredentialsInput): CompletableFuture<LoginTrackerCredentialsPayload> {
        val tracker =
            requireNotNull(TrackerManager.getTracker(input.trackerId)) {
                "Could not find tracker"
@@ -97,11 +87,8 @@ class TrackMutation {
        val tracker: TrackerType,
    )

-    fun logoutTracker(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: LogoutTrackerInput,
-    ): CompletableFuture<LogoutTrackerPayload> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun logoutTracker(input: LogoutTrackerInput): CompletableFuture<LogoutTrackerPayload> {
        val tracker =
            requireNotNull(TrackerManager.getTracker(input.trackerId)) {
                "Could not find tracker"
@@ -134,11 +121,8 @@ class TrackMutation {
        val trackRecord: TrackRecordType,
    )

-    fun bindTrack(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: BindTrackInput,
-    ): CompletableFuture<BindTrackPayload> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun bindTrack(input: BindTrackInput): CompletableFuture<BindTrackPayload> {
        val (clientMutationId, mangaId, trackerId, remoteId, private) = input

        return future {
@@ -173,11 +157,8 @@ class TrackMutation {
        val trackRecord: TrackRecordType,
    )

-    fun fetchTrack(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: FetchTrackInput,
-    ): CompletableFuture<FetchTrackPayload> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun fetchTrack(input: FetchTrackInput): CompletableFuture<FetchTrackPayload> {
        val (clientMutationId, recordId) = input

        return future {
@@ -209,11 +190,8 @@ class TrackMutation {
        val trackRecord: TrackRecordType?,
    )

-    fun unbindTrack(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UnbindTrackInput,
-    ): CompletableFuture<UnbindTrackPayload> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun unbindTrack(input: UnbindTrackInput): CompletableFuture<UnbindTrackPayload> {
        val (clientMutationId, recordId, deleteRemoteTrack) = input

        return future {
@@ -243,11 +221,8 @@ class TrackMutation {
        val trackRecords: List<TrackRecordType>,
    )

-    fun trackProgress(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: TrackProgressInput,
-    ): CompletableFuture<DataFetcherResult<TrackProgressPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun trackProgress(input: TrackProgressInput): CompletableFuture<DataFetcherResult<TrackProgressPayload?>> {
        val (clientMutationId, mangaId) = input

        return future {
@@ -289,12 +264,9 @@ class TrackMutation {
        val trackRecord: TrackRecordType?,
    )

-    fun updateTrack(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateTrackInput,
-    ): CompletableFuture<UpdateTrackPayload> =
+    @RequireAuth
+    fun updateTrack(input: UpdateTrackInput): CompletableFuture<UpdateTrackPayload> =
        future {
-            dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
            Track.update(
                Track.UpdateInput(
                    input.recordId,
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/UpdateMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/UpdateMutation.kt
@@ -1,19 +1,15 @@
 package suwayomi.tachidesk.graphql.mutations

 import graphql.execution.DataFetcherResult
-import graphql.schema.DataFetchingEnvironment
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.withTimeout
 import suwayomi.tachidesk.graphql.asDataFetcherResult
-import suwayomi.tachidesk.graphql.server.getAttribute
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.types.LibraryUpdateStatus
 import suwayomi.tachidesk.graphql.types.UpdateStatus
 import suwayomi.tachidesk.manga.impl.Category
 import suwayomi.tachidesk.manga.impl.update.IUpdater
-import suwayomi.tachidesk.server.JavalinSetup.Attribute
 import suwayomi.tachidesk.server.JavalinSetup.future
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
-import suwayomi.tachidesk.server.user.requireUser
 import uy.kohesive.injekt.injectLazy
 import java.util.concurrent.CompletableFuture
 import kotlin.time.Duration.Companion.seconds
@@ -31,11 +27,8 @@ class UpdateMutation {
        val updateStatus: LibraryUpdateStatus,
    )

-    fun updateLibrary(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateLibraryInput,
-    ): CompletableFuture<DataFetcherResult<UpdateLibraryPayload?>> {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun updateLibrary(input: UpdateLibraryInput): CompletableFuture<DataFetcherResult<UpdateLibraryPayload?>> {
        updater.addCategoriesToUpdateQueue(
            Category.getCategoryList().filter { input.categories?.contains(it.id) ?: true },
            clear = true,
@@ -66,12 +59,9 @@ class UpdateMutation {
        val updateStatus: UpdateStatus,
    )

-    fun updateLibraryManga(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateLibraryMangaInput,
-    ): CompletableFuture<DataFetcherResult<UpdateLibraryMangaPayload?>> {
+    @RequireAuth
+    fun updateLibraryManga(input: UpdateLibraryMangaInput): CompletableFuture<DataFetcherResult<UpdateLibraryMangaPayload?>> {
        updateLibrary(
-            dataFetchingEnvironment,
            UpdateLibraryInput(
                clientMutationId = input.clientMutationId,
                categories = null,
@@ -101,12 +91,9 @@ class UpdateMutation {
        val updateStatus: UpdateStatus,
    )

-    fun updateCategoryManga(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateCategoryMangaInput,
-    ): CompletableFuture<DataFetcherResult<UpdateCategoryMangaPayload?>> {
+    @RequireAuth
+    fun updateCategoryManga(input: UpdateCategoryMangaInput): CompletableFuture<DataFetcherResult<UpdateCategoryMangaPayload?>> {
        updateLibrary(
-            dataFetchingEnvironment,
            UpdateLibraryInput(
                clientMutationId = input.clientMutationId,
                categories = input.categories,
@@ -134,11 +121,8 @@ class UpdateMutation {
        val clientMutationId: String?,
    )

-    fun updateStop(
-        dataFetchingEnvironment: DataFetchingEnvironment,
-        input: UpdateStopInput,
-    ): UpdateStopPayload {
-        dataFetchingEnvironment.getAttribute(Attribute.TachideskUser).requireUser()
+    @RequireAuth
+    fun updateStop(input: UpdateStopInput): UpdateStopPayload {
        updater.reset()
        return UpdateStopPayload(input.clientMutationId)
    }
--- a/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/UserMutation.kt
+++ b/server/src/main/kotlin/suwayomi/tachidesk/graphql/mutations/UserMutation.kt
@@ -2,9 +2,9 @@ package suwayomi.tachidesk.graphql.mutations

 import graphql.schema.DataFetchingEnvironment
 import suwayomi.tachidesk.global.impl.util.Jwt
+import suwayomi.tachidesk.graphql.directives.RequireAuth
 import suwayomi.tachidesk.graphql.server.getAttribute
 import suwayomi.tachidesk.server.JavalinSetup.Attribute
-import suwayomi.tachidesk.server.JavalinSetup.getAttribute
 import suwayomi.tachidesk.server.serverConfig
 import suwayomi.tachidesk.server.user.UserType