@simtlix/simfinity-core 3.5.1 → 3.5.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simtlix/simfinity-core",
-  "version": "3.5.1",
+  "version": "3.5.2",
   "description": "Driver-free GraphQL runtime and model metadata for Simfinity",
   "type": "module",
   "main": "./src/index.js",

package/src/auth/expressions.js

@@ -4,6 +4,8 @@
  * distinct from false, so negation cannot turn an invalid comparison into a grant.
  */
 
+import { normalizeObjectId } from './object-id.js';
+
 const invalidResult = Symbol('invalid policy result');
 
 const isValidRef = (refPath) => {
@@ -25,6 +27,27 @@ const isValidValue = (value) => {
 const isDenseArray = value => Array.isArray(value)
   && Array.from({ length: value.length }, (_, index) => Object.hasOwn(value, index)).every(Boolean);
 
+const isPlainValue = value => value !== null && typeof value === 'object'
+  && (Array.isArray(value) || [Object.prototype, null].includes(Object.getPrototypeOf(value)));
+
+// Literals are compared as they are, so a `{ ref }` nested inside one would never be resolved.
+const containsReference = (value, seen = new Set()) => {
+  if (!isPlainValue(value) || seen.has(value)) return false;
+  if (isReference(value)) return true;
+  seen.add(value);
+  return Object.values(value).some(item => containsReference(item, seen));
+};
+
+const isMembershipItem = value => value === null || ['string', 'boolean', 'bigint'].includes(typeof value)
+  || (typeof value === 'number' && Number.isFinite(value)) || normalizeObjectId(value) !== undefined;
+
+const isValidComparison = (operator, operand) => {
+  if (!isDenseArray(operand) || operand.length !== 2 || !operand.every(isValidValue)) return false;
+  if (operand.some(value => !isReference(value) && containsReference(value))) return false;
+  if (operator !== 'in' || isReference(operand[1])) return true;
+  return isDenseArray(operand[1]) && operand[1].every(isMembershipItem);
+};
+
 const validateExpression = (expression, ancestors = new Set()) => {
   if (typeof expression === 'boolean') return true;
   if (expression === null || typeof expression !== 'object' || Array.isArray(expression)) return false;
@@ -38,8 +61,7 @@ const validateExpression = (expression, ancestors = new Set()) => {
     switch (operator) {
       case 'eq':
       case 'in':
-        return isDenseArray(operand) && operand.length === 2 && operand.every(isValidValue)
-          && (operator !== 'in' || Array.isArray(operand[1]) || isReference(operand[1]));
+        return isValidComparison(operator, operand);
       case 'allOf':
       case 'anyOf':
         return isDenseArray(operand) && operand.every(expr => validateExpression(expr, ancestors));
@@ -65,19 +87,56 @@ const resolveRef = (refPath, context) => {
   return value;
 };
 
+/**
+ * An operand of a created rule. The literal or reference classification is made once, when the
+ * rule is created, so mutating a literal object afterwards cannot turn it into a reference.
+ */
+class CompiledOperand {
+  constructor(reference, value) {
+    this.reference = reference;
+    this.value = value;
+    Object.freeze(this);
+  }
+}
+
 /** Resolve a literal or reference without coercing its value. */
 const resolveValue = (value, context) => {
+  if (value instanceof CompiledOperand) return value.reference ? resolveRef(value.value, context) : value.value;
   return isReference(value) ? resolveRef(value.ref, context) : value;
 };
 
+// Registered ObjectIds compare by hexadecimal value; every other value compares strictly.
+const comparable = value => normalizeObjectId(value) ?? value;
+
+// Strict equality never matches values of different types, such as a string and a number or a
+// primitive and a list. Such a comparison is invalid, so `not` cannot turn it into a grant.
+// null stays comparable with anything, as an explicit check for a missing value.
+const isMismatch = (left, right) => left !== null && right !== null && typeof left !== typeof right;
+
+const evaluateMembership = (target, list) => {
+  // A list or plain object is not a member value.
+  if (!Array.isArray(list) || isPlainValue(target)) return invalidResult;
+  // Never call the list's own includes: Mongoose arrays cast and compare loosely.
+  let mismatched = false;
+  for (let index = 0; index < list.length; index++) {
+    const item = comparable(list[index]);
+    if (item === target) return true;
+    if (isMismatch(target, item)) mismatched = true;
+  }
+  // Without a match, an item of another type means the list could not be checked reliably.
+  return mismatched ? invalidResult : false;
+};
+
 const evaluateComparison = (operator, operands, context) => {
   const left = resolveValue(operands[0], context);
   const right = resolveValue(operands[1], context);
   if (left === undefined || right === undefined || typeof left === 'function' || typeof right === 'function') {
     return invalidResult;
   }
-  if (operator === 'eq') return left === right;
-  return Array.isArray(right) ? right.includes(left) : invalidResult;
+  const target = comparable(left);
+  if (operator === 'in') return evaluateMembership(target, right);
+  const other = comparable(right);
+  return isMismatch(target, other) ? invalidResult : target === other;
 };
 
 const evaluateAllOf = (expressions, context) => {
@@ -140,12 +199,46 @@ export const evaluateExpression = (expression, context) => {
 /** Check the complete AST, including boolean literals and every nested branch. */
 export const isPolicyExpression = value => validateExpression(value);
 
+// Copy by index with built-in methods only, so an Array subclass cannot alter the copy.
+const copyArray = (array, transform = value => value) => Array.from(
+  { length: array.length },
+  (_, index) => transform(array[index], index),
+);
+
+const compileOperand = (operator, value, index) => {
+  if (isReference(value)) return new CompiledOperand(true, value.ref);
+  // A literal membership list is copied, so only its validated items are compared.
+  if (operator === 'in' && index === 1) return new CompiledOperand(false, Object.freeze(copyArray(value)));
+  // Other literals keep their identity, which equality compares.
+  return new CompiledOperand(false, value);
+};
+
+const snapshotOperands = (operator, operand) => Object.freeze(
+  copyArray(operand, (value, index) => compileOperand(operator, value, index)),
+);
+
+/**
+ * Copy the validated structure, so evaluation needs no revalidation and later changes to the
+ * configured object cannot make it malformed. Other literal operands keep their identity.
+ */
+const snapshotExpression = (expression) => {
+  if (typeof expression === 'boolean') return expression;
+  const snapshot = {};
+  for (const [operator, operand] of Object.entries(expression)) {
+    if (operator === 'not') snapshot[operator] = snapshotExpression(operand);
+    else if (operator === 'eq' || operator === 'in') snapshot[operator] = snapshotOperands(operator, operand);
+    else snapshot[operator] = Object.freeze(copyArray(operand, snapshotExpression));
+  }
+  return Object.freeze(snapshot);
+};
+
 /** Create a rule, rejecting malformed policies at configuration time. */
 export const createRuleFromExpression = (expression) => {
   if (!isPolicyExpression(expression)) {
     throw new TypeError('Invalid authorization policy expression');
   }
-  return (parent, args, ctx) => evaluateExpression(expression, { parent, args, ctx });
+  const snapshot = snapshotExpression(expression);
+  return (parent, args, ctx) => evaluateValidatedExpression(snapshot, { parent, args, ctx }) === true;
 };
 
 const expressions = {

package/src/auth/index.js

@@ -9,13 +9,12 @@
  * - Default allow/deny policies
  *
  * @example
- * import { auth } from '@simtlix/simfinity-js';
+ * import { createAuthPlugin, requireAuth, requireRole } from '@simtlix/simfinity-core/auth';
  * import { createYoga } from 'graphql-yoga';
  *
- * const { createAuthPlugin, requireAuth, requireRole } = auth;
- *
+ * // Simfinity names its roots `RootQueryType` and `Mutation`.
  * const permissions = {
- *   Query: {
+ *   RootQueryType: {
  *     series: requireAuth(),
  *     seasons: requireAuth(),
  *   },
@@ -32,7 +31,7 @@
  * const yoga = createYoga({ schema, plugins: [authPlugin] });
  */
 
-import { GraphQLError, GraphQLObjectType, defaultFieldResolver } from 'graphql';
+import { GraphQLError, GraphQLObjectType, defaultFieldResolver, __Field } from 'graphql';
 import SimfinityError from '../errors/simfinity.error.js';
 import { UnauthenticatedError, ForbiddenError, createAuthError } from './errors.js';
 import { isPolicyExpression, createRuleFromExpression, evaluateExpression } from './expressions.js';
@@ -128,6 +127,27 @@ const normalizeRule = (rule) => {
 const isPermissionMap = value => value !== null && typeof value === 'object'
   && [Object.prototype, null].includes(Object.getPrototypeOf(value));
 
+/**
+ * Simfinity adds an `extensions` field to introspection's `__Field`. Its object types are shared by
+ * every schema in the process and describe the schema itself, so authorization skips them like
+ * `__` types unless the permission map names them. They are matched by identity.
+ */
+const isSimfinityMetadataType = (type) => {
+  const extensionsType = __Field.getFields().extensions?.type;
+  if (!(extensionsType instanceof GraphQLObjectType)) return false;
+  return type === extensionsType || type === extensionsType.getFields().relation?.type;
+};
+
+const isExemptMetadataType = (permissions, type) => isSimfinityMetadataType(type)
+  && !Object.hasOwn(permissions, type.name);
+
+// Schemas processed by any auth plugin instance. A wrapper defers to the other instances only in
+// these schemas; in a schema no instance processed, every wrapper keeps enforcing its rules.
+const authorizedSchemas = new WeakSet();
+
+const isThenable = value => value !== null && (typeof value === 'object' || typeof value === 'function')
+  && typeof value.then === 'function';
+
 const validateConfiguration = (permissions, defaultPolicy) => {
   if (defaultPolicy !== 'ALLOW' && defaultPolicy !== 'DENY') {
     throw new TypeError('defaultPolicy must be ALLOW or DENY');
@@ -262,6 +282,7 @@ export const createAuthMiddleware = (permissions, options = {}) => {
    * Returns a middleware object keyed by type name, each containing field resolvers
    */
   return async (resolve, parent, args, ctx, info) => {
+    if (isExemptMetadataType(permissions, info.parentType)) return resolve(parent, args, ctx, info);
     const typeName = info.parentType.name;
     const fieldName = info.fieldName;
 
@@ -305,35 +326,20 @@ export const createAuthMiddleware = (permissions, options = {}) => {
 };
 
 /**
- * Creates a field-level middleware object from a permission schema.
- * This can be used with graphql-middleware's applyMiddleware.
+ * Creates graphql-middleware authorization for every object field of a schema.
+ *
+ * It returns the same function as {@link createAuthMiddleware}. graphql-middleware applies a
+ * function middleware to every field, so `'*'` rules and the default policy also apply to fields
+ * the permission map does not name. A map of only the named fields would leave the others open.
  *
  * @deprecated Use {@link createAuthPlugin} instead. `applyMiddleware` from graphql-middleware
  * can cause duplicate-type errors when the schema contains custom introspection extensions.
  *
  * @param {PermissionSchema} permissions - The permission schema
  * @param {AuthMiddlewareOptions} [options={}] - Middleware options
- * @returns {Object} Field middleware object compatible with graphql-middleware
+ * @returns {Function} A graphql-middleware compatible middleware function
  */
-export const createFieldMiddleware = (permissions, options = {}) => {
-  const middleware = createAuthMiddleware(permissions, options);
-  const fieldMiddleware = {};
-
-  for (const typeName of Object.keys(permissions)) {
-    fieldMiddleware[typeName] = {};
-
-    const typePerms = permissions[typeName];
-    for (const fieldName of Object.keys(typePerms)) {
-      if (fieldName === '*') {
-        // Wildcard rules are handled by the middleware internally
-        continue;
-      }
-      fieldMiddleware[typeName][fieldName] = middleware;
-    }
-  }
-
-  return fieldMiddleware;
-};
+export const createFieldMiddleware = (permissions, options = {}) => createAuthMiddleware(permissions, options);
 
 /**
  * Creates an Envelop-compatible authorization plugin that wraps schema resolvers in-place.
@@ -347,21 +353,25 @@ export const createFieldMiddleware = (permissions, options = {}) => {
  * @returns {Object} An Envelop plugin with an `onSchemaChange` hook
  *
  * @example
- * import { auth } from '@simtlix/simfinity-js';
+ * import { createAuthPlugin, requireAuth, requireRole } from '@simtlix/simfinity-core/auth';
  * import { createYoga } from 'graphql-yoga';
  *
+ * // Keys are the schema's type names: Simfinity names its query root `RootQueryType`.
  * const permissions = {
- *   Query: {
- *     users: requireAuth(),
- *     adminDashboard: requireRole('ADMIN')
+ *   RootQueryType: {
+ *     series: requireAuth(),
+ *     serie: requireAuth(),
  *   },
- *   User: {
+ *   Mutation: {
+ *     deleteserie: requireRole('ADMIN'),
+ *   },
+ *   serie: {
  *     '*': requireAuth(),
- *     email: requireRole('ADMIN')
- *   }
+ *     budget: requireRole('ADMIN'),
+ *   },
  * };
  *
- * const authPlugin = auth.createAuthPlugin(permissions, { defaultPolicy: 'DENY' });
+ * const authPlugin = createAuthPlugin(permissions, { defaultPolicy: 'DENY' });
  * const yoga = createYoga({ schema, plugins: [authPlugin] });
  */
 export const createAuthPlugin = (permissions, options = {}) => {
@@ -374,57 +384,108 @@ export const createAuthPlugin = (permissions, options = {}) => {
 
   const log = debug ? console.log.bind(console, '[auth]') : () => {};
   const processedSchemas = new WeakSet();
+  // Schemas built from the same types share their field objects, so each field is wrapped once.
+  const wrappers = new WeakMap();
+  let warnedAboutQueryRoot = false;
+
+  const warnAboutQueryRoot = (schema) => {
+    if (warnedAboutQueryRoot || !Object.hasOwn(permissions, 'Query') || schema.getType('Query')) return;
+    const queryRoot = schema.getQueryType()?.name;
+    if (!queryRoot) return;
+    warnedAboutQueryRoot = true;
+    console.warn(`[auth] Permissions for type "Query" match no type in the schema. Its query root is named "${queryRoot}"; did you mean "${queryRoot}"?`);
+  };
+
+  const createFieldResolver = (schema, typeName, fieldName, rules, query, originalResolve) => {
+    const key = `${typeName}.${fieldName}`;
+    const denied = () => Promise.reject(new ForbiddenError(`Access denied to ${key}`));
+
+    // Errors keep reaching GraphQL as rejections, as they did when the whole check was async.
+    const resolveField = (parent, args, ctx, info) => {
+      try {
+        return originalResolve(parent, args, ctx, info);
+      } catch (error) {
+        return Promise.reject(error);
+      }
+    };
+
+    const grant = (parent, args, ctx, info) => {
+      if (!query) return resolveField(parent, args, ctx, info);
+      return authorizeQueryPaths(permissions, defaultPolicy, info?.schema ?? schema, query, args, ctx, info)
+        .then(() => resolveField(parent, args, ctx, info));
+    };
+
+    // Rules run in order and synchronously until one returns a promise.
+    const runRules = (index, parent, args, ctx, info) => {
+      for (let current = index; current < rules.length; current++) {
+        if (debug) log(`Executing rule for ${key}`);
+        let result;
+        try {
+          result = rules[current](parent, args, ctx, info);
+        } catch (error) {
+          return Promise.reject(error);
+        }
+        if (isThenable(result)) {
+          return Promise.resolve(result).then(value => (
+            value === true || value === undefined ? runRules(current + 1, parent, args, ctx, info) : deny()
+          ));
+        }
+        if (result !== true && result !== undefined) return deny();
+      }
+      if (debug) log(`Access granted to ${key}`);
+      return grant(parent, args, ctx, info);
+    };
+
+    const deny = () => {
+      if (debug) log(`Rule denied access to ${key}`);
+      return denied();
+    };
+
+    return (parent, args, ctx, info) => {
+      // In a schema that only other auth plugin instances processed, their rules apply, not these.
+      if (info?.schema && authorizedSchemas.has(info.schema) && !processedSchemas.has(info.schema)) {
+        return originalResolve(parent, args, ctx, info);
+      }
+      if (debug) log(`Checking ${key}`);
+
+      if (rules === null) {
+        if (debug) log(`No rules for ${key}, applying default policy: ${defaultPolicy}`);
+        return defaultPolicy === 'DENY' ? denied() : grant(parent, args, ctx, info);
+      }
+      return runRules(0, parent, args, ctx, info);
+    };
+  };
 
   const wrapSchemaResolvers = (schema) => {
     if (processedSchemas.has(schema)) return;
     validateConfiguration(permissions, defaultPolicy);
+    warnAboutQueryRoot(schema);
 
     const typeMap = schema.getTypeMap();
 
     for (const [typeName, type] of Object.entries(typeMap)) {
-      if (!(type instanceof GraphQLObjectType) || typeName.startsWith('__')) continue;
+      if (!(type instanceof GraphQLObjectType) || typeName.startsWith('__') || isExemptMetadataType(permissions, type)) continue;
 
       const fields = type.getFields();
 
       for (const [fieldName, field] of Object.entries(fields)) {
+        // Skip fields this plugin already wraps; a resolver replaced since then is wrapped again.
+        const wrapper = wrappers.get(field);
+        if (wrapper !== undefined && wrapper === field.resolve) continue;
+
         const rules = getFieldRules(permissions, typeName, fieldName);
-        const originalResolve = field.resolve || defaultFieldResolver;
         const query = field.extensions?.simfinityQuery;
+        // An allowed field with no rule and no client query paths has nothing to check.
+        if (rules === null && defaultPolicy === 'ALLOW' && !query && !debug) continue;
 
-        field.resolve = async (parent, args, ctx, info) => {
-          log(`Checking ${typeName}.${fieldName}`);
-
-          if (rules === null) {
-            log(`No rules for ${typeName}.${fieldName}, applying default policy: ${defaultPolicy}`);
-
-            if (defaultPolicy === 'DENY') {
-              throw new ForbiddenError(`Access denied to ${typeName}.${fieldName}`);
-            }
-
-            await authorizeQueryPaths(permissions, defaultPolicy, schema, query, args, ctx, info);
-            return originalResolve(parent, args, ctx, info);
-          }
-
-          for (const rule of rules) {
-            log(`Executing rule for ${typeName}.${fieldName}`);
-
-            const allowed = await executeRule(rule, parent, args, ctx, info);
-
-            if (!allowed) {
-              log(`Rule denied access to ${typeName}.${fieldName}`);
-              throw new ForbiddenError(`Access denied to ${typeName}.${fieldName}`);
-            }
-          }
-
-          await authorizeQueryPaths(permissions, defaultPolicy, schema, query, args, ctx, info);
-          log(`Access granted to ${typeName}.${fieldName}`);
-
-          return originalResolve(parent, args, ctx, info);
-        };
+        const resolver = createFieldResolver(schema, typeName, fieldName, rules, query, field.resolve || defaultFieldResolver);
+        field.resolve = resolver;
+        wrappers.set(field, resolver);
       }
     }
 
     processedSchemas.add(schema);
+    authorizedSchemas.add(schema);
   };
 
   return {

package/src/auth/rules.js

@@ -26,6 +26,24 @@ export const resolvePath = (obj, pathOrFn) => {
   return undefined;
 };
 
+// Built-in rules also have a check that returns true, false or a factory for the denial error.
+// anyRule uses it so a denial that a later rule overrides never builds and throws an error.
+// Checks are keyed by the rule function itself: a property would be copied by Object.assign or
+// read through a Proxy, and anyRule would then skip the checks of a wrapping function.
+const checks = new WeakMap();
+
+const ruleFromCheck = (check) => {
+  const rule = (parent, args, ctx, info) => {
+    const result = check(parent, args, ctx, info);
+    if (typeof result === 'function') throw result();
+    return result;
+  };
+  checks.set(rule, check);
+  return rule;
+};
+
+const unauthenticated = () => new UnauthenticatedError('You must be logged in to access this resource');
+
 /**
  * Rule that requires the user to be authenticated
  * Checks for user existence at the specified path in context
@@ -37,16 +55,10 @@ export const resolvePath = (obj, pathOrFn) => {
  * requireAuth('session.currentUser') // checks ctx.session.currentUser
  */
 export const requireAuth = (userPath = 'user') => {
-  return (_parent, _args, ctx) => {
-    if (!ctx) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
-    const user = resolvePath(ctx, userPath);
-    if (!user) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
+  return ruleFromCheck((_parent, _args, ctx) => {
+    if (!ctx || !resolvePath(ctx, userPath)) return unauthenticated;
     return true;
-  };
+  });
 };
 
 /**
@@ -62,29 +74,40 @@ export const requireAuth = (userPath = 'user') => {
  * requireRole('ADMIN', { userPath: 'auth.user', rolePath: 'roles.primary' })
  */
 export const requireRole = (role, options = {}) => {
-  const roles = Array.isArray(role) ? role : [role];
+  // Copy the list, so changing the caller's array later cannot bypass this validation.
+  const roles = Object.freeze(Array.isArray(role) ? Array.from(role) : [role]);
   if (roles.length === 0 || Array.from(roles).some(value => typeof value !== 'string' || value.length === 0)) {
     throw new TypeError('Required roles must be a nonempty string or array of nonempty strings');
   }
   const { userPath = 'user', rolePath = 'role' } = options;
+  const forbidden = () => new ForbiddenError(`Requires role: ${roles.join(' or ')}`);
 
-  return (_parent, _args, ctx) => {
-    if (!ctx) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
+  return ruleFromCheck((_parent, _args, ctx) => {
+    if (!ctx) return unauthenticated;
     const user = resolvePath(ctx, userPath);
-    if (!user) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
+    if (!user) return unauthenticated;
 
     const userRole = resolvePath(user, rolePath);
+    return roles.includes(userRole) ? true : forbidden;
+  });
+};
 
-    if (!roles.includes(userRole)) {
-      throw new ForbiddenError(`Requires role: ${roles.join(' or ')}`);
-    }
-
-    return true;
-  };
+/**
+ * Validate the claims and find the required permissions they hold in one pass, without copying
+ * them. Returns null for malformed claims (including holes) and true for a standalone '*' entry.
+ * Nothing is cached: a context can outlive a request, and claims can change in place.
+ */
+const findHeldPermissions = (claims, requiredPermissions) => {
+  if (!Array.isArray(claims)) return null;
+  let wildcard = false;
+  const held = new Set();
+  for (let index = 0; index < claims.length; index++) {
+    const claim = claims[index];
+    if (typeof claim !== 'string' || claim.length === 0) return null;
+    if (claim === '*') wildcard = true;
+    else if (requiredPermissions.includes(claim)) held.add(claim);
+  }
+  return wildcard || held;
 };
 
 /**
@@ -100,42 +123,33 @@ export const requireRole = (role, options = {}) => {
  * requirePermission('posts:read', { userPath: 'auth.user', permissionsPath: 'grants' })
  */
 export const requirePermission = (permission, options = {}) => {
-  const requiredPermissions = Array.isArray(permission) ? permission : [permission];
+  // Copy the list, so changing the caller's array later cannot bypass this validation.
+  const requiredPermissions = Object.freeze(Array.isArray(permission) ? Array.from(permission) : [permission]);
   if (requiredPermissions.length === 0
     || Array.from(requiredPermissions).some(perm => typeof perm !== 'string' || perm.length === 0)) {
     throw new TypeError('Required permissions must be a nonempty string or array of nonempty strings');
   }
   const { userPath = 'user', permissionsPath = 'permissions' } = options;
 
-  return (_parent, _args, ctx) => {
-    if (!ctx) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
+  return ruleFromCheck((_parent, _args, ctx) => {
+    if (!ctx) return unauthenticated;
     const user = resolvePath(ctx, userPath);
-    if (!user) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
+    if (!user) return unauthenticated;
 
-    const userPermissions = resolvePath(user, permissionsPath);
-    if (!Array.isArray(userPermissions)
-      || Array.from(userPermissions).some(perm => typeof perm !== 'string' || perm.length === 0)) {
-      throw new ForbiddenError('User permissions must be an array of nonempty strings');
+    const held = findHeldPermissions(resolvePath(user, permissionsPath), requiredPermissions);
+    if (held === null) {
+      return () => new ForbiddenError('User permissions must be an array of nonempty strings');
     }
 
-    // Check if user has wildcard permission
-    if (userPermissions.includes('*')) {
+    // A wildcard entry grants every permission
+    if (held === true) {
       return true;
     }
 
     // All required permissions must be present
-    for (const perm of requiredPermissions) {
-      if (!userPermissions.includes(perm)) {
-        throw new ForbiddenError(`Missing permission: ${perm}`);
-      }
-    }
-
-    return true;
-  };
+    const missing = requiredPermissions.find(perm => !held.has(perm));
+    return missing === undefined ? true : () => new ForbiddenError(`Missing permission: ${missing}`);
+  });
 };
 
 /**
@@ -144,6 +158,10 @@ export const requirePermission = (permission, options = {}) => {
  * @returns {Function} Composed rule function
  */
 export const composeRules = (...rules) => {
+  // With no rules the composition would grant everything; use allow() for an intentional grant.
+  if (rules.length === 0) {
+    throw new TypeError('composeRules requires at least one rule');
+  }
   if (rules.some(rule => typeof rule !== 'function')) {
     throw new TypeError('composeRules requires rule functions');
   }
@@ -166,25 +184,38 @@ export const composeRules = (...rules) => {
  * @returns {Function} Combined rule function
  */
 export const anyRule = (...rules) => {
+  if (rules.length === 0) {
+    throw new TypeError('anyRule requires at least one rule');
+  }
   if (rules.some(rule => typeof rule !== 'function')) {
     throw new TypeError('anyRule requires rule functions');
   }
   return async (parent, args, ctx, info) => {
     let lastError = null;
+    // A built-in rule's denial is kept as a factory and only built if it is the error thrown.
+    let lastErrorIsFactory = false;
 
     for (const rule of rules) {
       try {
-        const result = await rule(parent, args, ctx, info);
-        if (result === true || result === undefined) {
+        const check = checks.get(rule);
+        const result = check ? check(parent, args, ctx, info) : await rule(parent, args, ctx, info);
+        if (check && typeof result === 'function') {
+          lastError = result;
+          lastErrorIsFactory = true;
+        } else if (result === true || result === undefined) {
           return true; // At least one rule passed
         }
       } catch (error) {
         lastError = error;
+        lastErrorIsFactory = false;
         // Continue to next rule
       }
     }
 
     // No rule passed - throw the last error or return false
+    if (lastErrorIsFactory) {
+      throw lastError();
+    }
     if (lastError) {
       throw lastError;
     }
@@ -214,14 +245,10 @@ const normalizeOwnerId = (value) => {
 export const isOwner = (ownerField = 'userId', userIdField = 'id', options = {}) => {
   const { userPath = 'user' } = options;
 
-  return (parent, _args, ctx) => {
-    if (!ctx) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
+  return ruleFromCheck((parent, _args, ctx) => {
+    if (!ctx) return unauthenticated;
     const user = resolvePath(ctx, userPath);
-    if (!user) {
-      throw new UnauthenticatedError('You must be logged in to access this resource');
-    }
+    if (!user) return unauthenticated;
 
     // Get ownerId from parent (using path or function)
     const ownerId = normalizeOwnerId(resolvePath(parent, ownerField));
@@ -234,7 +261,7 @@ export const isOwner = (ownerField = 'userId', userIdField = 'id', options = {})
     }
 
     return ownerId === userId;
-  };
+  });
 };
 
 /**
@@ -276,9 +303,8 @@ export const allow = () => {
  * @returns {Function} Rule function that always throws ForbiddenError
  */
 export const deny = (message = 'Access denied') => {
-  return () => {
-    throw new ForbiddenError(message);
-  };
+  const forbidden = () => new ForbiddenError(message);
+  return ruleFromCheck(() => forbidden);
 };
 
 // Export all rules as an object for convenience

package/types/index.d.ts

@@ -255,11 +255,14 @@ export const auth: {
     permissions: PermissionSchema,
     options?: AuthPluginOptions,
   ): (resolve: any, parent: any, args: any, ctx: any, info: any) => Promise<any>;
-  /** @deprecated Use createAuthPlugin instead. Field middleware object for graphql-middleware. */
+  /**
+   * @deprecated Use createAuthPlugin instead. The same graphql-middleware function as
+   * createAuthMiddleware, which applies wildcard rules and the default policy to every field.
+   */
   createFieldMiddleware(
     permissions: PermissionSchema,
     options?: AuthPluginOptions,
-  ): Record<string, Record<string, any>>;
+  ): (resolve: any, parent: any, args: any, ctx: any, info: any) => Promise<any>;
   resolvePath(obj: any, pathOrFn: string | ((obj: any) => any)): any;
   requireAuth(userPath?: string): AuthRuleFunction;
   /** Required roles must be nonempty strings; invalid configuration throws TypeError. */
@@ -269,7 +272,9 @@ export const auth: {
     permission: string | string[],
     options?: { userPath?: string; permissionsPath?: string },
   ): AuthRuleFunction;
+  /** Requires at least one rule function; throws TypeError otherwise. */
   composeRules(...rules: AuthRuleFunction[]): AuthRuleFunction;
+  /** Requires at least one rule function; throws TypeError otherwise. */
   anyRule(...rules: AuthRuleFunction[]): AuthRuleFunction;
   /** Compares nonempty string, finite number, or MongoDB ObjectId identities; missing IDs deny. */
   isOwner(ownerField?: string, userIdField?: string, options?: { userPath?: string }): AuthRuleFunction;