Merge branch 'current' into goodnetnick-shloginotp-T4754

21 files changed, 555 insertions, 212 deletions

diff --git a/src/services/api/graphql/__init__.py b/src/services/api/graphql/__init__.py
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/src/services/api/graphql/__init__.py
diff --git a/src/services/api/graphql/bindings.py b/src/services/api/graphql/bindings.py
index 0b1260912..aa1ba0eb0 100644
--- a/src/services/api/graphql/bindings.py
+++ b/src/services/api/graphql/bindings.py
@@ -18,16 +18,26 @@ from . graphql.queries import query
 from . graphql.mutations import mutation
 from . graphql.directives import directives_dict
 from . graphql.errors import op_mode_error
-from . utils.schema_from_op_mode import generate_op_mode_definitions
+from . graphql.auth_token_mutation import auth_token_mutation
+from . generate.schema_from_op_mode import generate_op_mode_definitions
+from . generate.schema_from_config_session import generate_config_session_definitions
+from . generate.schema_from_composite import generate_composite_definitions
+from . libs.token_auth import init_secret
+from . import state
 from ariadne import make_executable_schema, load_schema_from_path, snake_case_fallback_resolvers
 
 def generate_schema():
     api_schema_dir = vyos.defaults.directories['api_schema']
 
     generate_op_mode_definitions()
+    generate_config_session_definitions()
+    generate_composite_definitions()
+
+    if state.settings['app'].state.vyos_auth_type == 'token':
+        init_secret()
 
     type_defs = load_schema_from_path(api_schema_dir)
 
-    schema = make_executable_schema(type_defs, query, op_mode_error, mutation, snake_case_fallback_resolvers, directives=directives_dict)
+    schema = make_executable_schema(type_defs, query, op_mode_error, mutation, auth_token_mutation, snake_case_fallback_resolvers, directives=directives_dict)
 
     return schema
diff --git a/src/services/api/graphql/generate/composite_function.py b/src/services/api/graphql/generate/composite_function.py
new file mode 100644
index 000000000..bc9d80fbb
--- /dev/null
+++ b/src/services/api/graphql/generate/composite_function.py
@@ -0,0 +1,11 @@
+# typing information for composite functions: those that invoke several
+# elementary requests, and return the result as a single dict
+import typing
+
+def system_status():
+    pass
+
+queries = {'system_status': system_status}
+
+mutations = {}
+
diff --git a/src/services/api/graphql/utils/config_session_function.py b/src/services/api/graphql/generate/config_session_function.py
index fc0dd7a87..fc0dd7a87 100644
--- a/src/services/api/graphql/utils/config_session_function.py
+++ b/src/services/api/graphql/generate/config_session_function.py
diff --git a/src/services/api/graphql/generate/schema_from_composite.py b/src/services/api/graphql/generate/schema_from_composite.py
new file mode 100755
index 000000000..61a08cb2f
--- /dev/null
+++ b/src/services/api/graphql/generate/schema_from_composite.py
@@ -0,0 +1,165 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+#
+# A utility to generate GraphQL schema defintions from typing information of
+# composite functions comprising several requests.
+
+import os
+import sys
+import json
+from inspect import signature, getmembers, isfunction, isclass, getmro
+from jinja2 import Template
+
+from vyos.defaults import directories
+if __package__ is None or __package__ == '':
+    sys.path.append("/usr/libexec/vyos/services/api")
+    from graphql.libs.op_mode import snake_to_pascal_case, map_type_name
+    from composite_function import queries, mutations
+    from vyos.config import Config
+    from vyos.configdict import dict_merge
+    from vyos.xml import defaults
+else:
+    from .. libs.op_mode import snake_to_pascal_case, map_type_name
+    from . composite_function import queries, mutations
+    from .. import state
+
+SCHEMA_PATH = directories['api_schema']
+
+if __package__ is None or __package__ == '':
+    # allow running stand-alone
+    conf = Config()
+    base = ['service', 'https', 'api']
+    graphql_dict = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                          no_tag_node_value_mangle=True,
+                                          get_first_key=True)
+    if 'graphql' not in graphql_dict:
+        exit("graphql is not configured")
+
+    graphql_dict = dict_merge(defaults(base), graphql_dict)
+    auth_type = graphql_dict['graphql']['authentication']['type']
+else:
+    auth_type = state.settings['app'].state.vyos_auth_type
+
+schema_data: dict = {'auth_type': auth_type,
+                     'schema_name': '',
+                     'schema_fields': []}
+
+query_template  = """
+{%- if auth_type == 'key' %}
+input {{ schema_name }}Input {
+    key: String!
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- elif schema_fields %}
+input {{ schema_name }}Input {
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- endif %}
+
+type {{ schema_name }} {
+    result: Generic
+}
+
+type {{ schema_name }}Result {
+    data: {{ schema_name }}
+    success: Boolean!
+    errors: [String]
+}
+
+extend type Query {
+{%- if auth_type == 'key' or schema_fields %}
+    {{ schema_name }}(data: {{ schema_name }}Input) : {{ schema_name }}Result @compositequery
+{%- else %}
+    {{ schema_name }} : {{ schema_name }}Result @compositequery
+{%- endif %}
+}
+"""
+
+mutation_template  = """
+{%- if auth_type == 'key' %}
+input {{ schema_name }}Input {
+    key: String!
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- elif schema_fields %}
+input {{ schema_name }}Input {
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- endif %}
+
+type {{ schema_name }} {
+    result: Generic
+}
+
+type {{ schema_name }}Result {
+    data: {{ schema_name }}
+    success: Boolean!
+    errors: [String]
+}
+
+extend type Mutation {
+{%- if auth_type == 'key' or schema_fields %}
+    {{ schema_name }}(data: {{ schema_name }}Input) : {{ schema_name }}Result @compositemutation
+{%- else %}
+    {{ schema_name }} : {{ schema_name }}Result @compositemutation
+{%- endif %}
+}
+"""
+
+def create_schema(func_name: str, func: callable, template: str) -> str:
+    sig = signature(func)
+
+    field_dict = {}
+    for k in sig.parameters:
+        field_dict[sig.parameters[k].name] = map_type_name(sig.parameters[k].annotation)
+
+    schema_fields = []
+    for k,v in field_dict.items():
+        schema_fields.append(k+': '+v)
+
+    schema_data['schema_name'] = snake_to_pascal_case(func_name)
+    schema_data['schema_fields'] = schema_fields
+
+    j2_template = Template(template)
+    res = j2_template.render(schema_data)
+
+    return res
+
+def generate_composite_definitions():
+    results = []
+    for name,func in queries.items():
+        res = create_schema(name, func, query_template)
+        results.append(res)
+
+    for name,func in mutations.items():
+        res = create_schema(name, func, mutation_template)
+        results.append(res)
+
+    out = '\n'.join(results)
+    with open(f'{SCHEMA_PATH}/composite.graphql', 'w') as f:
+        f.write(out)
+
+if __name__ == '__main__':
+    generate_composite_definitions()
diff --git a/src/services/api/graphql/utils/schema_from_config_session.py b/src/services/api/graphql/generate/schema_from_config_session.py
index ea78aaf88..49bf2440e 100755
--- a/src/services/api/graphql/utils/schema_from_config_session.py
+++ b/src/services/api/graphql/generate/schema_from_config_session.py
@@ -19,28 +19,60 @@
 # (wrappers of) native configsession functions.
 
 import os
+import sys
 import json
 from inspect import signature, getmembers, isfunction, isclass, getmro
 from jinja2 import Template
 
+from vyos.defaults import directories
 if __package__ is None or __package__ == '':
-    from util import snake_to_pascal_case, map_type_name
+    sys.path.append("/usr/libexec/vyos/services/api")
+    from graphql.libs.op_mode import snake_to_pascal_case, map_type_name
+    from config_session_function import queries, mutations
+    from vyos.config import Config
+    from vyos.configdict import dict_merge
+    from vyos.xml import defaults
 else:
-    from . util import snake_to_pascal_case, map_type_name
+    from .. libs.op_mode import snake_to_pascal_case, map_type_name
+    from . config_session_function import queries, mutations
+    from .. import state
+
+SCHEMA_PATH = directories['api_schema']
 
-# this will be run locally before the build
-SCHEMA_PATH = '../graphql/schema'
+if __package__ is None or __package__ == '':
+    # allow running stand-alone
+    conf = Config()
+    base = ['service', 'https', 'api']
+    graphql_dict = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                          no_tag_node_value_mangle=True,
+                                          get_first_key=True)
+    if 'graphql' not in graphql_dict:
+        exit("graphql is not configured")
+
+    graphql_dict = dict_merge(defaults(base), graphql_dict)
+    auth_type = graphql_dict['graphql']['authentication']['type']
+else:
+    auth_type = state.settings['app'].state.vyos_auth_type
 
-schema_data: dict = {'schema_name': '',
+schema_data: dict = {'auth_type': auth_type,
+                     'schema_name': '',
                      'schema_fields': []}
 
 query_template  = """
+{%- if auth_type == 'key' %}
 input {{ schema_name }}Input {
     key: String!
     {%- for field_entry in schema_fields %}
     {{ field_entry }}
     {%- endfor %}
 }
+{%- elif schema_fields %}
+input {{ schema_name }}Input {
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- endif %}
 
 type {{ schema_name }} {
     result: Generic
@@ -53,17 +85,29 @@ type {{ schema_name }}Result {
 }
 
 extend type Query {
+{%- if auth_type == 'key' or schema_fields %}
     {{ schema_name }}(data: {{ schema_name }}Input) : {{ schema_name }}Result @configsessionquery
+{%- else %}
+    {{ schema_name }} : {{ schema_name }}Result @configsessionquery
+{%- endif %}
 }
 """
 
 mutation_template  = """
+{%- if auth_type == 'key' %}
 input {{ schema_name }}Input {
     key: String!
     {%- for field_entry in schema_fields %}
     {{ field_entry }}
     {%- endfor %}
 }
+{%- elif schema_fields %}
+input {{ schema_name }}Input {
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- endif %}
 
 type {{ schema_name }} {
     result: Generic
@@ -76,7 +120,11 @@ type {{ schema_name }}Result {
 }
 
 extend type Mutation {
+{%- if auth_type == 'key' or schema_fields %}
     {{ schema_name }}(data: {{ schema_name }}Input) : {{ schema_name }}Result @configsessionmutation
+{%- else %}
+    {{ schema_name }} : {{ schema_name }}Result @configsessionmutation
+{%- endif %}
 }
 """
 
@@ -100,8 +148,6 @@ def create_schema(func_name: str, func: callable, template: str) -> str:
     return res
 
 def generate_config_session_definitions():
-    from config_session_function import queries, mutations
-
     results = []
     for name,func in queries.items():
         res = create_schema(name, func, query_template)
diff --git a/src/services/api/graphql/utils/schema_from_op_mode.py b/src/services/api/graphql/generate/schema_from_op_mode.py
index 57d63628b..fc63b0100 100755
--- a/src/services/api/graphql/utils/schema_from_op_mode.py
+++ b/src/services/api/graphql/generate/schema_from_op_mode.py
@@ -19,17 +19,24 @@
 # scripts.
 
 import os
+import sys
 import json
 from inspect import signature, getmembers, isfunction, isclass, getmro
 from jinja2 import Template
 
 from vyos.defaults import directories
+from vyos.util import load_as_module
 if __package__ is None or __package__ == '':
-    from util import load_as_module, is_op_mode_function_name, is_show_function_name
-    from util import snake_to_pascal_case, map_type_name
+    sys.path.append("/usr/libexec/vyos/services/api")
+    from graphql.libs.op_mode import is_op_mode_function_name, is_show_function_name
+    from graphql.libs.op_mode import snake_to_pascal_case, map_type_name
+    from vyos.config import Config
+    from vyos.configdict import dict_merge
+    from vyos.xml import defaults
 else:
-    from . util import load_as_module, is_op_mode_function_name, is_show_function_name
-    from . util import snake_to_pascal_case, map_type_name
+    from .. libs.op_mode import is_op_mode_function_name, is_show_function_name
+    from .. libs.op_mode import snake_to_pascal_case, map_type_name
+    from .. import state
 
 OP_MODE_PATH = directories['op_mode']
 SCHEMA_PATH = directories['api_schema']
@@ -38,16 +45,40 @@ DATA_DIR = directories['data']
 op_mode_include_file = os.path.join(DATA_DIR, 'op-mode-standardized.json')
 op_mode_error_schema = 'op_mode_error.graphql'
 
-schema_data: dict = {'schema_name': '',
+if __package__ is None or __package__ == '':
+    # allow running stand-alone
+    conf = Config()
+    base = ['service', 'https', 'api']
+    graphql_dict = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                          no_tag_node_value_mangle=True,
+                                          get_first_key=True)
+    if 'graphql' not in graphql_dict:
+        exit("graphql is not configured")
+
+    graphql_dict = dict_merge(defaults(base), graphql_dict)
+    auth_type = graphql_dict['graphql']['authentication']['type']
+else:
+    auth_type = state.settings['app'].state.vyos_auth_type
+
+schema_data: dict = {'auth_type': auth_type,
+                     'schema_name': '',
                      'schema_fields': []}
 
 query_template  = """
+{%- if auth_type == 'key' %}
 input {{ schema_name }}Input {
     key: String!
     {%- for field_entry in schema_fields %}
     {{ field_entry }}
     {%- endfor %}
 }
+{%- elif schema_fields %}
+input {{ schema_name }}Input {
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- endif %}
 
 type {{ schema_name }} {
     result: Generic
@@ -61,17 +92,29 @@ type {{ schema_name }}Result {
 }
 
 extend type Query {
+{%- if auth_type == 'key' or schema_fields %}
     {{ schema_name }}(data: {{ schema_name }}Input) : {{ schema_name }}Result @genopquery
+{%- else %}
+    {{ schema_name }} : {{ schema_name }}Result @genopquery
+{%- endif %}
 }
 """
 
 mutation_template  = """
+{%- if auth_type == 'key' %}
 input {{ schema_name }}Input {
     key: String!
     {%- for field_entry in schema_fields %}
     {{ field_entry }}
     {%- endfor %}
 }
+{%- elif schema_fields %}
+input {{ schema_name }}Input {
+    {%- for field_entry in schema_fields %}
+    {{ field_entry }}
+    {%- endfor %}
+}
+{%- endif %}
 
 type {{ schema_name }} {
     result: Generic
@@ -85,7 +128,11 @@ type {{ schema_name }}Result {
 }
 
 extend type Mutation {
+{%- if auth_type == 'key' or schema_fields %}
     {{ schema_name }}(data: {{ schema_name }}Input) : {{ schema_name }}Result @genopmutation
+{%- else %}
+    {{ schema_name }} : {{ schema_name }}Result @genopquery
+{%- endif %}
 }
 """
 
diff --git a/src/services/api/graphql/graphql/auth_token_mutation.py b/src/services/api/graphql/graphql/auth_token_mutation.py
new file mode 100644
index 000000000..21ac40094
--- /dev/null
+++ b/src/services/api/graphql/graphql/auth_token_mutation.py
@@ -0,0 +1,49 @@
+# Copyright 2022 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+import jwt
+import datetime
+from typing import Any, Dict
+from ariadne import ObjectType, UnionType
+from graphql import GraphQLResolveInfo
+
+from .. libs.token_auth import generate_token
+from .. import state
+
+auth_token_mutation = ObjectType("Mutation")
+
+@auth_token_mutation.field('AuthToken')
+def auth_token_resolver(obj: Any, info: GraphQLResolveInfo, data: Dict):
+    # non-nullable fields
+    user = data['username']
+    passwd = data['password']
+
+    secret = state.settings['secret']
+    exp_interval = int(state.settings['app'].state.vyos_token_exp)
+    expiration = (datetime.datetime.now(tz=datetime.timezone.utc) +
+                  datetime.timedelta(seconds=exp_interval))
+
+    res = generate_token(user, passwd, secret, expiration)
+    if res:
+        data['result'] = res
+        return {
+            "success": True,
+            "data": data
+        }
+
+    return {
+        "success": False,
+        "errors": ['token generation failed']
+    }
diff --git a/src/services/api/graphql/graphql/directives.py b/src/services/api/graphql/graphql/directives.py
index d75d72582..a7919854a 100644
--- a/src/services/api/graphql/graphql/directives.py
+++ b/src/services/api/graphql/graphql/directives.py
@@ -63,16 +63,25 @@ class GenOpMutationDirective(VyosDirective):
         super().visit_field_definition(field, object_type,
                                        make_resolver=make_gen_op_mutation_resolver)
 
-class SystemStatusDirective(VyosDirective):
+class CompositeQueryDirective(VyosDirective):
     """
     Class providing implementation of 'system_status' directive in schema.
     """
     def visit_field_definition(self, field, object_type):
         super().visit_field_definition(field, object_type,
-                                       make_resolver=make_system_status_resolver)
+                                       make_resolver=make_composite_query_resolver)
+
+class CompositeMutationDirective(VyosDirective):
+    """
+    Class providing implementation of 'system_status' directive in schema.
+    """
+    def visit_field_definition(self, field, object_type):
+        super().visit_field_definition(field, object_type,
+                                       make_resolver=make_composite_mutation_resolver)
 
 directives_dict = {"configsessionquery": ConfigSessionQueryDirective,
                    "configsessionmutation": ConfigSessionMutationDirective,
                    "genopquery": GenOpQueryDirective,
                    "genopmutation": GenOpMutationDirective,
-                   "systemstatus": SystemStatusDirective}
+                   "compositequery": CompositeQueryDirective,
+                   "compositemutation": CompositeMutationDirective}
diff --git a/src/services/api/graphql/graphql/mutations.py b/src/services/api/graphql/graphql/mutations.py
index f7d285a77..87ea59c43 100644
--- a/src/services/api/graphql/graphql/mutations.py
+++ b/src/services/api/graphql/graphql/mutations.py
@@ -14,13 +14,13 @@
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from importlib import import_module
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 from ariadne import ObjectType, convert_kwargs_to_snake_case, convert_camel_case_to_snake
 from graphql import GraphQLResolveInfo
 from makefun import with_signature
 
 from .. import state
-from .. import key_auth
+from .. libs import key_auth
 from api.graphql.session.session import Session
 from api.graphql.session.errors.op_mode_errors import op_mode_err_msg, op_mode_err_code
 from vyos.opmode import Error as OpModeError
@@ -42,32 +42,52 @@ def make_mutation_resolver(mutation_name, class_name, session_func):
 
     func_base_name = convert_camel_case_to_snake(class_name)
     resolver_name = f'resolve_{func_base_name}'
-    func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Dict)'
+    func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Optional[Dict]=None)'
 
     @mutation.field(mutation_name)
     @convert_kwargs_to_snake_case
     @with_signature(func_sig, func_name=resolver_name)
     async def func_impl(*args, **kwargs):
         try:
-            if 'data' not in kwargs:
-                return {
-                    "success": False,
-                    "errors": ['missing data']
-                }
-
-            data = kwargs['data']
-            key = data['key']
-
-            auth = key_auth.auth_required(key)
-            if auth is None:
-                return {
-                     "success": False,
-                     "errors": ['invalid API key']
-                }
-
-            # We are finished with the 'key' entry, and may remove so as to
-            # pass the rest of data (if any) to function.
-            del data['key']
+            auth_type = state.settings['app'].state.vyos_auth_type
+
+            if auth_type == 'key':
+                data = kwargs['data']
+                key = data['key']
+
+                auth = key_auth.auth_required(key)
+                if auth is None:
+                    return {
+                         "success": False,
+                         "errors": ['invalid API key']
+                    }
+
+                # We are finished with the 'key' entry, and may remove so as to
+                # pass the rest of data (if any) to function.
+                del data['key']
+
+            elif auth_type == 'token':
+                data = kwargs['data']
+                if data is None:
+                    data = {}
+                info = kwargs['info']
+                user = info.context.get('user')
+                if user is None:
+                    error = info.context.get('error')
+                    if error is not None:
+                        return {
+                            "success": False,
+                            "errors": [error]
+                        }
+                    return {
+                        "success": False,
+                        "errors": ['not authenticated']
+                    }
+            else:
+                # AtrributeError will have already been raised if no
+                # vyos_auth_type; validation and defaultValue ensure it is
+                # one of the previous cases, so this is never reached.
+                pass
 
             session = state.settings['app'].state.vyos_session
 
@@ -112,3 +132,7 @@ def make_config_session_mutation_resolver(mutation_name):
 
 def make_gen_op_mutation_resolver(mutation_name):
     return make_mutation_resolver(mutation_name, mutation_name, 'gen_op_mutation')
+
+def make_composite_mutation_resolver(mutation_name):
+    return make_mutation_resolver(mutation_name, mutation_name,
+                                  convert_camel_case_to_snake(mutation_name))
diff --git a/src/services/api/graphql/graphql/queries.py b/src/services/api/graphql/graphql/queries.py
index 5f3a7d005..1ad586428 100644
--- a/src/services/api/graphql/graphql/queries.py
+++ b/src/services/api/graphql/graphql/queries.py
@@ -14,13 +14,13 @@
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from importlib import import_module
-from typing import Any, Dict
+from typing import Any, Dict, Optional
 from ariadne import ObjectType, convert_kwargs_to_snake_case, convert_camel_case_to_snake
 from graphql import GraphQLResolveInfo
 from makefun import with_signature
 
 from .. import state
-from .. import key_auth
+from .. libs import key_auth
 from api.graphql.session.session import Session
 from api.graphql.session.errors.op_mode_errors import op_mode_err_msg, op_mode_err_code
 from vyos.opmode import Error as OpModeError
@@ -42,32 +42,52 @@ def make_query_resolver(query_name, class_name, session_func):
 
     func_base_name = convert_camel_case_to_snake(class_name)
     resolver_name = f'resolve_{func_base_name}'
-    func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Dict)'
+    func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Optional[Dict]=None)'
 
     @query.field(query_name)
     @convert_kwargs_to_snake_case
     @with_signature(func_sig, func_name=resolver_name)
     async def func_impl(*args, **kwargs):
         try:
-            if 'data' not in kwargs:
-                return {
-                    "success": False,
-                    "errors": ['missing data']
-                }
-
-            data = kwargs['data']
-            key = data['key']
-
-            auth = key_auth.auth_required(key)
-            if auth is None:
-                return {
-                     "success": False,
-                     "errors": ['invalid API key']
-                }
-
-            # We are finished with the 'key' entry, and may remove so as to
-            # pass the rest of data (if any) to function.
-            del data['key']
+            auth_type = state.settings['app'].state.vyos_auth_type
+
+            if auth_type == 'key':
+                data = kwargs['data']
+                key = data['key']
+
+                auth = key_auth.auth_required(key)
+                if auth is None:
+                    return {
+                         "success": False,
+                         "errors": ['invalid API key']
+                    }
+
+                # We are finished with the 'key' entry, and may remove so as to
+                # pass the rest of data (if any) to function.
+                del data['key']
+
+            elif auth_type == 'token':
+                data = kwargs['data']
+                if data is None:
+                    data = {}
+                info = kwargs['info']
+                user = info.context.get('user')
+                if user is None:
+                    error = info.context.get('error')
+                    if error is not None:
+                        return {
+                            "success": False,
+                            "errors": [error]
+                        }
+                    return {
+                        "success": False,
+                        "errors": ['not authenticated']
+                    }
+            else:
+                # AtrributeError will have already been raised if no
+                # vyos_auth_type; validation and defaultValue ensure it is
+                # one of the previous cases, so this is never reached.
+                pass
 
             session = state.settings['app'].state.vyos_session
 
@@ -113,5 +133,6 @@ def make_config_session_query_resolver(query_name):
 def make_gen_op_query_resolver(query_name):
     return make_query_resolver(query_name, query_name, 'gen_op_query')
 
-def make_system_status_resolver(query_name):
-    return make_query_resolver(query_name, query_name, 'system_status')
+def make_composite_query_resolver(query_name):
+    return make_query_resolver(query_name, query_name,
+                               convert_camel_case_to_snake(query_name))
diff --git a/src/services/api/graphql/graphql/schema/auth_token.graphql b/src/services/api/graphql/graphql/schema/auth_token.graphql
new file mode 100644
index 000000000..af53a293a
--- /dev/null
+++ b/src/services/api/graphql/graphql/schema/auth_token.graphql
@@ -0,0 +1,19 @@
+
+input AuthTokenInput {
+    username: String!
+    password: String!
+}
+
+type AuthToken {
+    result: Generic
+}
+
+type AuthTokenResult {
+    data: AuthToken
+    success: Boolean!
+    errors: [String]
+}
+
+extend type Mutation {
+    AuthToken(data: AuthTokenInput) : AuthTokenResult
+}
diff --git a/src/services/api/graphql/graphql/schema/configsession.graphql b/src/services/api/graphql/graphql/schema/configsession.graphql
deleted file mode 100644
index b1deac4b3..000000000
--- a/src/services/api/graphql/graphql/schema/configsession.graphql
+++ /dev/null
@@ -1,115 +0,0 @@
-
-input ShowConfigInput {
-    key: String!
-    path: [String!]!
-    configFormat: String = null
-}
-
-type ShowConfig {
-    result: Generic
-}
-
-type ShowConfigResult {
-    data: ShowConfig
-    success: Boolean!
-    errors: [String]
-}
-
-extend type Query {
-    ShowConfig(data: ShowConfigInput) : ShowConfigResult @configsessionquery
-}
-
-input ShowInput {
-    key: String!
-    path: [String!]!
-}
-
-type Show {
-    result: Generic
-}
-
-type ShowResult {
-    data: Show
-    success: Boolean!
-    errors: [String]
-}
-
-extend type Query {
-    Show(data: ShowInput) : ShowResult @configsessionquery
-}
-
-input SaveConfigFileInput {
-    key: String!
-    fileName: String = null
-}
-
-type SaveConfigFile {
-    result: Generic
-}
-
-type SaveConfigFileResult {
-    data: SaveConfigFile
-    success: Boolean!
-    errors: [String]
-}
-
-extend type Mutation {
-    SaveConfigFile(data: SaveConfigFileInput) : SaveConfigFileResult @configsessionmutation
-}
-
-input LoadConfigFileInput {
-    key: String!
-    fileName: String!
-}
-
-type LoadConfigFile {
-    result: Generic
-}
-
-type LoadConfigFileResult {
-    data: LoadConfigFile
-    success: Boolean!
-    errors: [String]
-}
-
-extend type Mutation {
-    LoadConfigFile(data: LoadConfigFileInput) : LoadConfigFileResult @configsessionmutation
-}
-
-input AddSystemImageInput {
-    key: String!
-    location: String!
-}
-
-type AddSystemImage {
-    result: Generic
-}
-
-type AddSystemImageResult {
-    data: AddSystemImage
-    success: Boolean!
-    errors: [String]
-}
-
-extend type Mutation {
-    AddSystemImage(data: AddSystemImageInput) : AddSystemImageResult @configsessionmutation
-}
-
-input DeleteSystemImageInput {
-    key: String!
-    name: String!
-}
-
-type DeleteSystemImage {
-    result: Generic
-}
-
-type DeleteSystemImageResult {
-    data: DeleteSystemImage
-    success: Boolean!
-    errors: [String]
-}
-
-extend type Mutation {
-    DeleteSystemImage(data: DeleteSystemImageInput) : DeleteSystemImageResult @configsessionmutation
-}
\ No newline at end of file
diff --git a/src/services/api/graphql/graphql/schema/schema.graphql b/src/services/api/graphql/graphql/schema/schema.graphql
index 2acecade4..62b0d30bb 100644
--- a/src/services/api/graphql/graphql/schema/schema.graphql
+++ b/src/services/api/graphql/graphql/schema/schema.graphql
@@ -3,7 +3,8 @@ schema {
     mutation: Mutation
 }
 
-directive @systemstatus on FIELD_DEFINITION
+directive @compositequery on FIELD_DEFINITION
+directive @compositemutation on FIELD_DEFINITION
 directive @configsessionquery on FIELD_DEFINITION
 directive @configsessionmutation on FIELD_DEFINITION
 directive @genopquery on FIELD_DEFINITION
@@ -11,8 +12,5 @@ directive @genopmutation on FIELD_DEFINITION
 
 scalar Generic
 
-type Query {
-    SystemStatus(data: SystemStatusInput) : SystemStatusResult @systemstatus
-}
-
+type Query
 type Mutation
diff --git a/src/services/api/graphql/graphql/schema/system_status.graphql b/src/services/api/graphql/graphql/schema/system_status.graphql
deleted file mode 100644
index be8d87535..000000000
--- a/src/services/api/graphql/graphql/schema/system_status.graphql
+++ /dev/null
@@ -1,18 +0,0 @@
-"""
-Use 'scalar Generic' for system status output, to avoid attempts to
-JSON-serialize in case of JSON output.
-"""
-
-input SystemStatusInput {
-    key: String!
-}
-
-type SystemStatus {
-    result: Generic
-}
-
-type SystemStatusResult {
-    data: SystemStatus
-    success: Boolean!
-    errors: [String]
-}
diff --git a/src/services/api/graphql/key_auth.py b/src/services/api/graphql/libs/key_auth.py
index f756ed6d8..2db0f7d48 100644
--- a/src/services/api/graphql/key_auth.py
+++ b/src/services/api/graphql/libs/key_auth.py
@@ -1,5 +1,5 @@
 
-from . import state
+from .. import state
 
 def check_auth(key_list, key):
     if not key_list:
diff --git a/src/services/api/graphql/utils/util.py b/src/services/api/graphql/libs/op_mode.py
index da2bcdb5b..6939ed5d6 100644
--- a/src/services/api/graphql/utils/util.py
+++ b/src/services/api/graphql/libs/op_mode.py
@@ -17,14 +17,12 @@ import os
 import re
 import typing
 import importlib.util
+from typing import Union
+from humps import decamelize
 
 from vyos.defaults import directories
-
-def load_as_module(name: str, path: str):
-    spec = importlib.util.spec_from_file_location(name, path)
-    mod = importlib.util.module_from_spec(spec)
-    spec.loader.exec_module(mod)
-    return mod
+from vyos.util import load_as_module
+from vyos.opmode import _normalize_field_names
 
 def load_op_mode_as_module(name: str):
     path = os.path.join(directories['op_mode'], name)
@@ -98,3 +96,6 @@ def map_type_name(type_name: type, optional: bool = False) -> str:
 
     # scalar 'Generic' is defined in schema.graphql
     return 'Generic'
+
+def normalize_output(result: Union[dict, list]) -> Union[dict, list]:
+    return _normalize_field_names(decamelize(result))
diff --git a/src/services/api/graphql/libs/token_auth.py b/src/services/api/graphql/libs/token_auth.py
new file mode 100644
index 000000000..2100eba7f
--- /dev/null
+++ b/src/services/api/graphql/libs/token_auth.py
@@ -0,0 +1,71 @@
+import jwt
+import uuid
+import pam
+from secrets import token_hex
+
+from .. import state
+
+def _check_passwd_pam(username: str, passwd: str) -> bool:
+    if pam.authenticate(username, passwd):
+        return True
+    return False
+
+def init_secret():
+    length = int(state.settings['app'].state.vyos_secret_len)
+    secret = token_hex(length)
+    state.settings['secret'] = secret
+
+def generate_token(user: str, passwd: str, secret: str, exp: int) -> dict:
+    if user is None or passwd is None:
+        return {}
+    if _check_passwd_pam(user, passwd):
+        app = state.settings['app']
+        try:
+            users = app.state.vyos_token_users
+        except AttributeError:
+            app.state.vyos_token_users = {}
+            users = app.state.vyos_token_users
+        user_id = uuid.uuid1().hex
+        payload_data = {'iss': user, 'sub': user_id, 'exp': exp}
+        secret = state.settings.get('secret')
+        if secret is None:
+            return {
+                    "success": False,
+                    "errors": ['failed secret generation']
+                   }
+        token = jwt.encode(payload=payload_data, key=secret, algorithm="HS256")
+
+        users |= {user_id: user}
+        return {'token': token}
+
+def get_user_context(request):
+    context = {}
+    context['request'] = request
+    context['user'] = None
+    if 'Authorization' in request.headers:
+        auth = request.headers['Authorization']
+        scheme, token = auth.split()
+        if scheme.lower() != 'bearer':
+            return context
+
+        try:
+            secret = state.settings.get('secret')
+            payload = jwt.decode(token, secret, algorithms=["HS256"])
+            user_id: str = payload.get('sub')
+            if user_id is None:
+                return context
+        except jwt.exceptions.ExpiredSignatureError:
+            context['error'] = 'expired token'
+            return context
+        except jwt.PyJWTError:
+            return context
+        try:
+            users = state.settings['app'].state.vyos_token_users
+        except AttributeError:
+            return context
+
+        user = users.get(user_id)
+        if user is not None:
+            context['user'] = user
+
+    return context
diff --git a/src/services/api/graphql/session/composite/system_status.py b/src/services/api/graphql/session/composite/system_status.py
index 3c1a3d45b..d809f32e3 100755
--- a/src/services/api/graphql/session/composite/system_status.py
+++ b/src/services/api/graphql/session/composite/system_status.py
@@ -23,7 +23,7 @@ import importlib.util
 
 from vyos.defaults import directories
 
-from api.graphql.utils.util import load_op_mode_as_module
+from api.graphql.libs.op_mode import load_op_mode_as_module
 
 def get_system_version() -> dict:
     show_version = load_op_mode_as_module('version.py')
diff --git a/src/services/api/graphql/session/errors/op_mode_errors.py b/src/services/api/graphql/session/errors/op_mode_errors.py
index 7ba75455d..7bc1d1d81 100644
--- a/src/services/api/graphql/session/errors/op_mode_errors.py
+++ b/src/services/api/graphql/session/errors/op_mode_errors.py
@@ -3,11 +3,13 @@
 op_mode_err_msg = {
     "UnconfiguredSubsystem": "subsystem is not configured or not running",
     "DataUnavailable": "data currently unavailable",
-    "PermissionDenied": "client does not have permission"
+    "PermissionDenied": "client does not have permission",
+    "IncorrectValue": "argument value is incorrect"
 }
 
 op_mode_err_code = {
     "UnconfiguredSubsystem": 2000,
     "DataUnavailable": 2001,
-    "PermissionDenied": 1003
+    "PermissionDenied": 1003,
+    "IncorrectValue": 1002
 }
diff --git a/src/services/api/graphql/session/session.py b/src/services/api/graphql/session/session.py
index f990e63d0..0b77b1433 100644
--- a/src/services/api/graphql/session/session.py
+++ b/src/services/api/graphql/session/session.py
@@ -24,7 +24,8 @@ from vyos.defaults import directories
 from vyos.template import render
 from vyos.opmode import Error as OpModeError
 
-from api.graphql.utils.util import load_op_mode_as_module, split_compound_op_mode_name
+from api.graphql.libs.op_mode import load_op_mode_as_module, split_compound_op_mode_name
+from api.graphql.libs.op_mode import normalize_output
 
 op_mode_include_file = os.path.join(directories['data'], 'op-mode-standardized.json')
 
@@ -149,6 +150,8 @@ class Session:
         except OpModeError as e:
             raise e
 
+        res = normalize_output(res)
+
         return res
 
     def gen_op_mutation(self):