[WIP] Proposal: add inaccessible_field feature

lib/graphql/authorization.rb

@@ -71,7 +71,13 @@ def final_value(memo)
           end
           context = memo[:context]
           err = InaccessibleFieldsError.new(fields: fields, irep_nodes: nodes, context: context)
-          context.schema.inaccessible_fields(err)
+
+          # TODO: fix
+          if context.schema.respond_to?(:inaccessible_field)
+            context[:inaccessible_nodes] = memo[:inaccessible_nodes]
+          else
+            context.schema.inaccessible_fields(err)
+          end
         else
           nil
         end

lib/graphql/schema/field.rb

@@ -310,6 +310,10 @@ def authorized?(object, context)
       #
       # Eventually, we might hook up field instances to execution in another way. TBD.
       def resolve_field(obj, args, ctx)
+        if ctx[:inaccessible_nodes] && ctx[:inaccessible_nodes].include?(ctx.irep_node)
+          ctx.schema.inaccessible_field(self)
+        end
+
         ctx.schema.after_lazy(obj) do |after_obj|
           # First, apply auth ...
           query_ctx = ctx.query.context

spec/graphql/authorization_spec.rb

@@ -588,6 +588,30 @@ def auth_execute(*args)
     end
   end
 
+  # TODO: fix
+  describe "applying the accessible? method when inaccessible_field is defined on schema" do
+    class AuthTest::Schema
+      def self.inaccessible_field(field)
+        raise GraphQL::ExecutionError.new("#{field.owner.graphql_name}.#{field.graphql_name} is not accessible")
+      end
+    end
+
+    it "works with fields and arguments" do
+      queries = {
+        "{ inaccessible }" => ["Query.inaccessible is not accessible"],
+        "{ int2(inaccessible: 1) }" => ["Query.int2 is not accessible"],
+      }
+
+      queries.each do |query_str, errors|
+        res = auth_execute(query_str, context: { hide: true })
+        assert_equal errors, res.fetch("errors").map { |e| e["message"] }
+
+        res = auth_execute(query_str, context: { hide: false })
+        refute res.key?("errors")
+      end
+    end
+  end
+
   describe "applying the authorized? method" do
     it "halts on unauthorized objects" do
       query = "{ unauthorizedObject { __typename } }"