Authorization checks not applied correctly for unions and interface

[hayes]

Was just skimming through some of the code when I fixed the __typename issue and it looks like authorization rules on objects are ignored when the query resolved them through a union or interface. This seems like a pretty important case to cover. This would make any nodes in a relay style graph accessible without auth checks through the node or nodes queries.

[dimatill]

@hayes thank you for opening the issue!

Just checked it and there are test cases for union and interface types, but you're right. Right now test cases only handle fields of union and interface types but there is an issue with rules attached to members of union or interface types themselves.

[JCMais]

is there a workaround for this atm? Or we have to patch the rules compiler so it properly builds the rule from the inline fragment?