Access denied logic

[Vincz]

Q	A
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Documented?	yes
Fixed tickets	#674
License	MIT

This PR adds the ability to return null instead of raising an exception when the access to a field is denied.
It will not enforce the field as nullable so field with an access must be configured properly.

@mcg-web I didn't force the field as nullable as it implied to modify the user defined schema and would for example modify all a type fields as nullable if the object has a fieldsDefaultAccess. Better to let the user implement the logic himself. Don't you think?

[mcg-web]

When security matter I always double check, but here my review part 1.

[Vincz]

@mcg-web Should we raise an exception when non boolean valus are returned from access callback or if the promise resolve to non boolean value ? Right now, if something other than true is return, it's an access denied and we raise an exception or a warning.

[murtukov]

@Vincz squashing commits after all tests pass would be nice

[Vincz]

@murtukov I'll try ! But I'm waiting for @mcg-web to complete is review as it's security related.

[mcg-web]

After re-reading this PR I don't really get it.
Lets take this example:

Query:
  type: object
  config:
    fields:
        user: User!

User:
  type: object
  config:
    fields:
        nullableField:
          type: String
          access: #...
       nonNullableField:
          type: String!
          access: #...

if a user without access requests nullableField

{ user { nullableField }

the result will be null with an access warning

{ "data": { "user": { "nullableField": null } }, "extensions": {"warnings": ["..."]} }

but if this same user requests nonNullableField

{ user { nonNullableField }

the result will be an error since the field can't be nullable

{ "data": null, "errors": ["..."] }

@Vincz What is the difference with your PR ? Can you provide an example please.

[Vincz]

@mcg-web You are right. The only difference is that we don't get the warning when the option nullOnDenied is set. It doesn't make sense without the nullable part. I'm sorry. I don't think clearly this day due to too much work. I need vacation. I'll have a break and check this later if I can address the nullable problem. Sorry again.

[mcg-web]

All this part of the bundle is not really clear, that's why in the next version we must try to make this easier. Not a big deal sorry for the time I take before seeing that this was not totally complete 😥 .