@simtlix/simfinity-core 3.5.1 → 3.5.3

package/README.md

@@ -8,15 +8,20 @@ For relational storage, `@simtlix/simfinity-sql` builds on core and delegates ph
 
 ## Runtime
 
-`createRuntime(adapter)` creates an isolated Simfinity runtime. Each instance owns its registrations, generated input types, middleware, scopes, hooks, custom mutations, and state machines. It exposes:
+`createRuntime(adapter)` creates a Simfinity runtime. Each instance owns its registrations, generated input types, middleware, scopes, hooks, custom mutations, and state machines; the GraphQL type objects it builds resolvers for are bound to it, and query and mutation limits are process-wide. It exposes:
 
 - `connect`, `addNoEndpointType`, and `createSchema` for registration and schema creation;
 - `getModel`, `getType`, `getInputType`, and `getRegistrations` for runtime inspection;
 - `use`, `registerMutation`, and `saveObject` for middleware and write orchestration;
-- `preventCreatingCollection` to pass validation-only storage setup to an adapter.
+- `preventCreatingCollection` to pass validation-only storage setup to an adapter;
+- `configureQueryLimits` and `configureMutationLimits` for the process-wide page-size and nested-operation limits.
 
 The adapter supplies model creation, identifiers, transactions, record reads and writes, queries, counts, aggregations, and inverse collection reads. `DatabaseAdapter`, `Runtime`, controller, middleware, registration, and state-machine interfaces are exported in the TypeScript declarations. A runtime binds one adapter; create another runtime to use another database or configuration. An adapter can also define `getByIds(model, ids, { context })`, which returns the records it finds in `getById` shape and any order; the runtime then batches generated single-reference reads per request and type, matching records by `castId`, splitting batches at `maxPageSize`, and reading an ID with `getById` when a batch read fails or when `castId` would normalize it.
 
+When a runtime first creates a schema, it binds each GraphQL object type whose non-embedded relation fields receive its generated resolvers. It also reserves each reachable object type that still has a non-embedded relation field without a resolver, such as an unregistered custom mutation result. Registering a bound or reserved type in another runtime, or building another runtime's schema that reaches it through fields, interfaces, union members or custom mutation results, throws `TYPE_BOUND_TO_OTHER_RUNTIME` (409). `createSchema()` also rejects a type with a relation field copied, by `toConfig()` or a field spread, after another runtime generated that field's resolver. Create type objects once per runtime, for example with a factory function. Types without non-embedded relation fields, and types whose relation fields all have application resolvers, can be shared, and another runtime can use a `toConfig()` copy made before the first runtime built its schema. A shared custom mutation result type with an unresolved relation field is rejected.
+
+Registration and `createSchema()` validate `extensions.scope` (`INVALID_SCOPE`) and reject list or embedded relations to unregistered types (`UNREGISTERED_RELATION_TARGET`); `use()` rejects non-functions (`INVALID_MIDDLEWARE`).
+
 Generated and custom mutations run through `adapter.withTransaction`. Retried attempts receive fresh clones of GraphQL input objects, lists, and dates while enum values keep their identity. An adapter can define `stateValue` when its persisted enum representation differs from GraphQL enum names.
 
 Importing the runtime installs Simfinity's `__Field.extensions` introspection field once per GraphQL module instance. Multiple runtimes and driver packages can be imported together without cloning schemas or duplicating introspection types.
@@ -27,4 +32,4 @@ Importing the runtime installs Simfinity's `__Field.extensions` introspection fi
 
 `createQueryPlan` and `resolveModelPath` turn Simfinity filter, sort, pagination, and aggregation inputs into a driver-neutral plan resolved against that metadata.
 
-The package also exports the `auth`, `validators`, `scalars`, and `plugins` helper namespaces alongside `createValidatedScalar`, `SimfinityError`, `InternalServerError`, `buildErrorFormatter`, `QLOperator`, `QLSort`, and `QLValue`. Database packages reuse these exports so helpers, errors, and globally named GraphQL types retain one identity.
+The package also exports the `auth`, `validators`, `scalars`, and `plugins` helper namespaces alongside `createValidatedScalar`, `SimfinityError`, `InternalServerError`, `buildErrorFormatter`, `configureQueryLimits`, `configureMutationLimits`, `QLOperator`, `QLSort`, and `QLValue`. `buildErrorFormatter` returns a `GraphQLError` whose `originalError` is the classified Simfinity error. Database packages reuse these exports so helpers, errors, and globally named GraphQL types retain one identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simtlix/simfinity-core",
-  "version": "3.5.1",
+  "version": "3.5.3",
   "description": "Driver-free GraphQL runtime and model metadata for Simfinity",
   "type": "module",
   "main": "./src/index.js",

package/src/auth/expressions.js

@@ -4,6 +4,9 @@
  * distinct from false, so negation cannot turn an invalid comparison into a grant.
  */
 
+import { normalizeObjectId } from './object-id.js';
+import { isThenable, discardThenable } from './thenable.js';
+
 const invalidResult = Symbol('invalid policy result');
 
 const isValidRef = (refPath) => {
@@ -19,12 +22,34 @@ const isValidValue = (value) => {
   if (isReference(value)) {
     return Object.keys(value).length === 1 && Object.hasOwn(value, 'ref') && isValidRef(value.ref);
   }
-  return value !== undefined && typeof value !== 'function' && typeof value !== 'symbol';
+  // NaN equals nothing, so a literal NaN is rejected, as in literal `in` lists.
+  return value !== undefined && typeof value !== 'function' && typeof value !== 'symbol' && !Number.isNaN(value);
 };
 
 const isDenseArray = value => Array.isArray(value)
   && Array.from({ length: value.length }, (_, index) => Object.hasOwn(value, index)).every(Boolean);
 
+const isPlainValue = value => value !== null && typeof value === 'object'
+  && (Array.isArray(value) || [Object.prototype, null].includes(Object.getPrototypeOf(value)));
+
+// Literals are compared as they are, so a `{ ref }` nested inside one would never be resolved.
+const containsReference = (value, seen = new Set()) => {
+  if (!isPlainValue(value) || seen.has(value)) return false;
+  if (isReference(value)) return true;
+  seen.add(value);
+  return Object.values(value).some(item => containsReference(item, seen));
+};
+
+const isMembershipItem = value => value === null || ['string', 'boolean', 'bigint'].includes(typeof value)
+  || (typeof value === 'number' && Number.isFinite(value)) || normalizeObjectId(value) !== undefined;
+
+const isValidComparison = (operator, operand) => {
+  if (!isDenseArray(operand) || operand.length !== 2 || !operand.every(isValidValue)) return false;
+  if (operand.some(value => !isReference(value) && containsReference(value))) return false;
+  if (operator !== 'in' || isReference(operand[1])) return true;
+  return isDenseArray(operand[1]) && operand[1].every(isMembershipItem);
+};
+
 const validateExpression = (expression, ancestors = new Set()) => {
   if (typeof expression === 'boolean') return true;
   if (expression === null || typeof expression !== 'object' || Array.isArray(expression)) return false;
@@ -38,8 +63,7 @@ const validateExpression = (expression, ancestors = new Set()) => {
     switch (operator) {
       case 'eq':
       case 'in':
-        return isDenseArray(operand) && operand.length === 2 && operand.every(isValidValue)
-          && (operator !== 'in' || Array.isArray(operand[1]) || isReference(operand[1]));
+        return isValidComparison(operator, operand);
       case 'allOf':
       case 'anyOf':
         return isDenseArray(operand) && operand.every(expr => validateExpression(expr, ancestors));
@@ -65,19 +89,111 @@ const resolveRef = (refPath, context) => {
   return value;
 };
 
+/**
+ * An operand of a created rule. The literal or reference classification is made once, when the
+ * rule is created, so mutating a literal object afterwards cannot turn it into a reference.
+ */
+class CompiledOperand {
+  constructor(reference, value) {
+    this.reference = reference;
+    this.value = value;
+    Object.freeze(this);
+  }
+}
+
 /** Resolve a literal or reference without coercing its value. */
 const resolveValue = (value, context) => {
+  if (value instanceof CompiledOperand) return value.reference ? resolveRef(value.value, context) : value.value;
   return isReference(value) ? resolveRef(value.ref, context) : value;
 };
 
+/**
+ * The time value of a genuine Date from any realm (NaN when invalid), or undefined for other values.
+ * The tag skips other objects cheaply; getTime then rejects objects that only spoof the tag.
+ */
+const dateTime = (value) => {
+  if (value === null || typeof value !== 'object') return undefined;
+  try {
+    return Object.prototype.toString.call(value) === '[object Date]' ? Date.prototype.getTime.call(value) : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+// Registered ObjectIds compare by hexadecimal value; other values except Dates compare strictly.
+const comparable = value => normalizeObjectId(value) ?? value;
+
+/**
+ * Classify the left value of a comparison once: a promise, null, NaN, a Date by its time, or another
+ * value in its comparable form. A membership list then repeats only the checks on its items.
+ */
+const classifyOperand = (value) => {
+  if (isThenable(value)) return { kind: 'promise', value: undefined };
+  if (value === null) return { kind: 'null', value };
+  if (Number.isNaN(value)) return { kind: 'nan', value };
+  const time = dateTime(value);
+  if (time !== undefined) return { kind: 'date', value: time };
+  return { kind: 'value', value: comparable(value) };
+};
+
+/**
+ * Compare a classified value with a resolved value: true, false, or invalidResult when they cannot
+ * be compared reliably. A promise is not its eventual value, so it is never compared; a rejected
+ * native one is handled, so it cannot crash the process. null stays comparable with anything else,
+ * as an explicit check for a missing value. NaN equals nothing, and Dates compare by time, only with
+ * valid Dates. Otherwise strict equality never matches values of different types, such as a string
+ * and a number. Such comparisons are invalid, so `not` cannot turn them into a grant.
+ */
+const compareOperand = (left, right) => {
+  if (isThenable(right)) {
+    discardThenable(right);
+    return invalidResult;
+  }
+  if (left.kind === 'promise') return invalidResult;
+  if (left.kind === 'null' || right === null) return left.kind === 'null' && right === null;
+  if (left.kind === 'nan' || Number.isNaN(right)) return invalidResult;
+  const rightTime = dateTime(right);
+  if (left.kind === 'date' || rightTime !== undefined) {
+    if (left.kind !== 'date' || rightTime === undefined || Number.isNaN(left.value) || Number.isNaN(rightTime)) {
+      return invalidResult;
+    }
+    return left.value === rightTime;
+  }
+  const other = comparable(right);
+  return typeof left.value !== typeof other ? invalidResult : left.value === other;
+};
+
+const evaluateMembership = (target, list) => {
+  // A list or plain object is not a member value.
+  if (!Array.isArray(list) || isPlainValue(target)) return invalidResult;
+  const operand = classifyOperand(target);
+  // Never call the list's own includes: Mongoose arrays cast and compare loosely.
+  let mismatched = false;
+  for (let index = 0; index < list.length; index++) {
+    const result = compareOperand(operand, list[index]);
+    if (result === true) return true;
+    if (result === invalidResult) mismatched = true;
+  }
+  // Without a match, an item that could not be compared means the list was not checked reliably.
+  return mismatched ? invalidResult : false;
+};
+
 const evaluateComparison = (operator, operands, context) => {
   const left = resolveValue(operands[0], context);
   const right = resolveValue(operands[1], context);
-  if (left === undefined || right === undefined || typeof left === 'function' || typeof right === 'function') {
+  // A promise is not its eventual value, so it cannot be compared, even with an empty list. A rejected
+  // native promise a ref yields, such as a lazy relation that failed to load, is handled so it cannot
+  // crash the process.
+  const leftThenable = isThenable(left);
+  const rightThenable = isThenable(right);
+  if (leftThenable) discardThenable(left);
+  if (rightThenable) discardThenable(right);
+  if (left === undefined || right === undefined || typeof left === 'function' || typeof right === 'function'
+    || leftThenable || rightThenable) {
     return invalidResult;
   }
-  if (operator === 'eq') return left === right;
-  return Array.isArray(right) ? right.includes(left) : invalidResult;
+  if (operator === 'in') return evaluateMembership(left, right);
+  return compareOperand(classifyOperand(left), right);
 };
 
 const evaluateAllOf = (expressions, context) => {
@@ -140,12 +256,50 @@ export const evaluateExpression = (expression, context) => {
 /** Check the complete AST, including boolean literals and every nested branch. */
 export const isPolicyExpression = value => validateExpression(value);
 
+// Copy by index with built-in methods only, so an Array subclass cannot alter the copy.
+const copyArray = (array, transform = value => value) => Array.from(
+  { length: array.length },
+  (_, index) => transform(array[index], index),
+);
+
+const compileOperand = (operator, value, index) => {
+  if (isReference(value)) return new CompiledOperand(true, value.ref);
+  // A literal membership list is copied, so only its validated items are compared.
+  if (operator === 'in' && index === 1) return new CompiledOperand(false, Object.freeze(copyArray(value)));
+  // A literal Date compares by time, so a private copy keeps setTime on the configured one out.
+  const time = dateTime(value);
+  if (time !== undefined) return new CompiledOperand(false, new Date(time));
+  // Other literals keep their identity, which equality compares.
+  return new CompiledOperand(false, value);
+};
+
+const snapshotOperands = (operator, operand) => Object.freeze(
+  copyArray(operand, (value, index) => compileOperand(operator, value, index)),
+);
+
+/**
+ * Copy the validated structure, so evaluation needs no revalidation and later changes to the
+ * configured object cannot make it malformed. Date literals are copied; other literal operands keep
+ * their identity.
+ */
+const snapshotExpression = (expression) => {
+  if (typeof expression === 'boolean') return expression;
+  const snapshot = {};
+  for (const [operator, operand] of Object.entries(expression)) {
+    if (operator === 'not') snapshot[operator] = snapshotExpression(operand);
+    else if (operator === 'eq' || operator === 'in') snapshot[operator] = snapshotOperands(operator, operand);
+    else snapshot[operator] = Object.freeze(copyArray(operand, snapshotExpression));
+  }
+  return Object.freeze(snapshot);
+};
+
 /** Create a rule, rejecting malformed policies at configuration time. */
 export const createRuleFromExpression = (expression) => {
   if (!isPolicyExpression(expression)) {
     throw new TypeError('Invalid authorization policy expression');
   }
-  return (parent, args, ctx) => evaluateExpression(expression, { parent, args, ctx });
+  const snapshot = snapshotExpression(expression);
+  return (parent, args, ctx) => evaluateValidatedExpression(snapshot, { parent, args, ctx }) === true;
 };
 
 const expressions = {

package/src/auth/index.js

@@ -9,13 +9,12 @@
  * - Default allow/deny policies
  *
  * @example
- * import { auth } from '@simtlix/simfinity-js';
+ * import { createAuthPlugin, requireAuth, requireRole } from '@simtlix/simfinity-core/auth';
  * import { createYoga } from 'graphql-yoga';
  *
- * const { createAuthPlugin, requireAuth, requireRole } = auth;
- *
+ * // Simfinity names its roots `RootQueryType` and `Mutation`.
  * const permissions = {
- *   Query: {
+ *   RootQueryType: {
  *     series: requireAuth(),
  *     seasons: requireAuth(),
  *   },
@@ -32,11 +31,23 @@
  * const yoga = createYoga({ schema, plugins: [authPlugin] });
  */
 
-import { GraphQLError, GraphQLObjectType, defaultFieldResolver } from 'graphql';
+import {
+  GraphQLError,
+  GraphQLEnumType,
+  GraphQLInputObjectType,
+  GraphQLInterfaceType,
+  GraphQLObjectType,
+  GraphQLScalarType,
+  GraphQLUnionType,
+  defaultFieldResolver,
+  __Field,
+} from 'graphql';
 import SimfinityError from '../errors/simfinity.error.js';
 import { UnauthenticatedError, ForbiddenError, createAuthError } from './errors.js';
 import { isPolicyExpression, createRuleFromExpression, evaluateExpression } from './expressions.js';
 import { collectQueryPaths, walkQueryPath } from '../query-plan.js';
+import { relationFieldOwners } from '../relation-owners.js';
+import { isThenable } from './thenable.js';
 import {
   resolvePath,
   requireAuth,
@@ -128,6 +139,39 @@ const normalizeRule = (rule) => {
 const isPermissionMap = value => value !== null && typeof value === 'object'
   && [Object.prototype, null].includes(Object.getPrototypeOf(value));
 
+/**
+ * Simfinity adds an `extensions` field to introspection's `__Field`. Its object types are shared by
+ * every schema in the process and describe the schema itself, so authorization skips them like
+ * `__` types unless the permission map names them. They are matched by identity.
+ */
+const isSimfinityMetadataType = (type) => {
+  const extensionsType = __Field.getFields().extensions?.type;
+  if (!(extensionsType instanceof GraphQLObjectType)) return false;
+  return type === extensionsType || type === extensionsType.getFields().relation?.type;
+};
+
+const isExemptMetadataType = (permissions, type) => isSimfinityMetadataType(type)
+  && !Object.hasOwn(permissions, type.name);
+
+// Schemas processed by any auth plugin instance. A wrapper defers to the other instances only in
+// these schemas; in a schema no instance processed, every wrapper keeps enforcing its rules.
+const authorizedSchemas = new WeakSet();
+
+const namedTypeClasses = [
+  GraphQLObjectType, GraphQLInterfaceType, GraphQLUnionType,
+  GraphQLScalarType, GraphQLEnumType, GraphQLInputObjectType,
+];
+
+/**
+ * A type created by another copy of graphql (a second installed version, or its ESM and CommonJS
+ * builds loaded together) fails `instanceof`, so it cannot be classified and its fields could not be
+ * protected. graphql's own isObjectType only reports such copies outside production.
+ */
+const assertSameGraphQLModule = (typeName, type) => {
+  if (namedTypeClasses.some(NamedType => type instanceof NamedType)) return;
+  throw new TypeError(`Cannot authorize type ${typeName}: it was created by a different copy of the graphql module than the auth plugin uses. Install a single graphql version and load it through one entry point.`);
+};
+
 const validateConfiguration = (permissions, defaultPolicy) => {
   if (defaultPolicy !== 'ALLOW' && defaultPolicy !== 'DENY') {
     throw new TypeError('defaultPolicy must be ALLOW or DENY');
@@ -262,6 +306,7 @@ export const createAuthMiddleware = (permissions, options = {}) => {
    * Returns a middleware object keyed by type name, each containing field resolvers
    */
   return async (resolve, parent, args, ctx, info) => {
+    if (isExemptMetadataType(permissions, info.parentType)) return resolve(parent, args, ctx, info);
     const typeName = info.parentType.name;
     const fieldName = info.fieldName;
 
@@ -305,35 +350,20 @@ export const createAuthMiddleware = (permissions, options = {}) => {
 };
 
 /**
- * Creates a field-level middleware object from a permission schema.
- * This can be used with graphql-middleware's applyMiddleware.
+ * Creates graphql-middleware authorization for every object field of a schema.
+ *
+ * It returns the same function as {@link createAuthMiddleware}. graphql-middleware applies a
+ * function middleware to every field, so `'*'` rules and the default policy also apply to fields
+ * the permission map does not name. A map of only the named fields would leave the others open.
  *
  * @deprecated Use {@link createAuthPlugin} instead. `applyMiddleware` from graphql-middleware
  * can cause duplicate-type errors when the schema contains custom introspection extensions.
  *
  * @param {PermissionSchema} permissions - The permission schema
  * @param {AuthMiddlewareOptions} [options={}] - Middleware options
- * @returns {Object} Field middleware object compatible with graphql-middleware
+ * @returns {Function} A graphql-middleware compatible middleware function
  */
-export const createFieldMiddleware = (permissions, options = {}) => {
-  const middleware = createAuthMiddleware(permissions, options);
-  const fieldMiddleware = {};
-
-  for (const typeName of Object.keys(permissions)) {
-    fieldMiddleware[typeName] = {};
-
-    const typePerms = permissions[typeName];
-    for (const fieldName of Object.keys(typePerms)) {
-      if (fieldName === '*') {
-        // Wildcard rules are handled by the middleware internally
-        continue;
-      }
-      fieldMiddleware[typeName][fieldName] = middleware;
-    }
-  }
-
-  return fieldMiddleware;
-};
+export const createFieldMiddleware = (permissions, options = {}) => createAuthMiddleware(permissions, options);
 
 /**
  * Creates an Envelop-compatible authorization plugin that wraps schema resolvers in-place.
@@ -342,26 +372,33 @@ export const createFieldMiddleware = (permissions, options = {}) => {
  * and rebuilds the schema), this plugin mutates resolvers directly on the existing schema,
  * avoiding schema reconstruction and the duplicate-type errors it can cause.
  *
+ * `onSchemaChange` throws `TypeError` before wrapping any field when a schema type was created by
+ * another copy of the graphql module, instead of leaving that type's fields unprotected.
+ *
  * @param {PermissionSchema} permissions - The permission schema object
  * @param {AuthMiddlewareOptions} [options={}] - Plugin options
  * @returns {Object} An Envelop plugin with an `onSchemaChange` hook
  *
  * @example
- * import { auth } from '@simtlix/simfinity-js';
+ * import { createAuthPlugin, requireAuth, requireRole } from '@simtlix/simfinity-core/auth';
  * import { createYoga } from 'graphql-yoga';
  *
+ * // Keys are the schema's type names: Simfinity names its query root `RootQueryType`.
  * const permissions = {
- *   Query: {
- *     users: requireAuth(),
- *     adminDashboard: requireRole('ADMIN')
+ *   RootQueryType: {
+ *     series: requireAuth(),
+ *     serie: requireAuth(),
  *   },
- *   User: {
+ *   Mutation: {
+ *     deleteserie: requireRole('ADMIN'),
+ *   },
+ *   serie: {
  *     '*': requireAuth(),
- *     email: requireRole('ADMIN')
- *   }
+ *     budget: requireRole('ADMIN'),
+ *   },
  * };
  *
- * const authPlugin = auth.createAuthPlugin(permissions, { defaultPolicy: 'DENY' });
+ * const authPlugin = createAuthPlugin(permissions, { defaultPolicy: 'DENY' });
  * const yoga = createYoga({ schema, plugins: [authPlugin] });
  */
 export const createAuthPlugin = (permissions, options = {}) => {
@@ -374,57 +411,117 @@ export const createAuthPlugin = (permissions, options = {}) => {
 
   const log = debug ? console.log.bind(console, '[auth]') : () => {};
   const processedSchemas = new WeakSet();
+  // Schemas built from the same types share their field objects, so each field is wrapped once.
+  const wrappers = new WeakMap();
+  let warnedAboutQueryRoot = false;
+
+  const warnAboutQueryRoot = (schema) => {
+    if (warnedAboutQueryRoot || !Object.hasOwn(permissions, 'Query') || schema.getType('Query')) return;
+    const queryRoot = schema.getQueryType()?.name;
+    if (!queryRoot) return;
+    warnedAboutQueryRoot = true;
+    console.warn(`[auth] Permissions for type "Query" match no type in the schema. Its query root is named "${queryRoot}"; did you mean "${queryRoot}"?`);
+  };
+
+  const createFieldResolver = (schema, typeName, fieldName, rules, query, originalResolve) => {
+    const key = `${typeName}.${fieldName}`;
+    const denied = () => Promise.reject(new ForbiddenError(`Access denied to ${key}`));
+
+    // Errors keep reaching GraphQL as rejections, as they did when the whole check was async.
+    const resolveField = (parent, args, ctx, info) => {
+      try {
+        return originalResolve(parent, args, ctx, info);
+      } catch (error) {
+        return Promise.reject(error);
+      }
+    };
+
+    const grant = (parent, args, ctx, info) => {
+      if (!query) return resolveField(parent, args, ctx, info);
+      return authorizeQueryPaths(permissions, defaultPolicy, info?.schema ?? schema, query, args, ctx, info)
+        .then(() => resolveField(parent, args, ctx, info));
+    };
+
+    // Rules run in order and synchronously until one returns a promise.
+    const runRules = (index, parent, args, ctx, info) => {
+      for (let current = index; current < rules.length; current++) {
+        if (debug) log(`Executing rule for ${key}`);
+        let result;
+        try {
+          result = rules[current](parent, args, ctx, info);
+        } catch (error) {
+          return Promise.reject(error);
+        }
+        if (isThenable(result)) {
+          return Promise.resolve(result).then(value => (
+            value === true || value === undefined ? runRules(current + 1, parent, args, ctx, info) : deny()
+          ));
+        }
+        if (result !== true && result !== undefined) return deny();
+      }
+      if (debug) log(`Access granted to ${key}`);
+      return grant(parent, args, ctx, info);
+    };
+
+    const deny = () => {
+      if (debug) log(`Rule denied access to ${key}`);
+      return denied();
+    };
+
+    const resolver = (parent, args, ctx, info) => {
+      // In a schema that only other auth plugin instances processed, their rules apply, not these.
+      if (info?.schema && authorizedSchemas.has(info.schema) && !processedSchemas.has(info.schema)) {
+        return originalResolve(parent, args, ctx, info);
+      }
+      if (debug) log(`Checking ${key}`);
+
+      if (rules === null) {
+        if (debug) log(`No rules for ${key}, applying default policy: ${defaultPolicy}`);
+        return defaultPolicy === 'DENY' ? denied() : grant(parent, args, ctx, info);
+      }
+      return runRules(0, parent, args, ctx, info);
+    };
+    // The wrapper still reads through the runtime that generated a relation resolver, so a field
+    // copied with it stays bound to that runtime.
+    const owner = relationFieldOwners.get(originalResolve);
+    if (owner !== undefined) relationFieldOwners.set(resolver, owner);
+    return resolver;
+  };
 
   const wrapSchemaResolvers = (schema) => {
     if (processedSchemas.has(schema)) return;
     validateConfiguration(permissions, defaultPolicy);
+    warnAboutQueryRoot(schema);
+
+    // Check every type before wrapping any field, so an unsupported schema is left unchanged.
+    const objectTypes = [];
+    for (const [typeName, type] of Object.entries(schema.getTypeMap())) {
+      if (typeName.startsWith('__')) continue;
+      assertSameGraphQLModule(typeName, type);
+      if (type instanceof GraphQLObjectType && !isExemptMetadataType(permissions, type)) objectTypes.push([typeName, type]);
+    }
 
-    const typeMap = schema.getTypeMap();
-
-    for (const [typeName, type] of Object.entries(typeMap)) {
-      if (!(type instanceof GraphQLObjectType) || typeName.startsWith('__')) continue;
-
+    for (const [typeName, type] of objectTypes) {
       const fields = type.getFields();
 
       for (const [fieldName, field] of Object.entries(fields)) {
+        // Skip fields this plugin already wraps; a resolver replaced since then is wrapped again.
+        const wrapper = wrappers.get(field);
+        if (wrapper !== undefined && wrapper === field.resolve) continue;
+
         const rules = getFieldRules(permissions, typeName, fieldName);
-        const originalResolve = field.resolve || defaultFieldResolver;
         const query = field.extensions?.simfinityQuery;
+        // An allowed field with no rule and no client query paths has nothing to check.
+        if (rules === null && defaultPolicy === 'ALLOW' && !query && !debug) continue;
 
-        field.resolve = async (parent, args, ctx, info) => {
-          log(`Checking ${typeName}.${fieldName}`);
-
-          if (rules === null) {
-            log(`No rules for ${typeName}.${fieldName}, applying default policy: ${defaultPolicy}`);
-
-            if (defaultPolicy === 'DENY') {
-              throw new ForbiddenError(`Access denied to ${typeName}.${fieldName}`);
-            }
-
-            await authorizeQueryPaths(permissions, defaultPolicy, schema, query, args, ctx, info);
-            return originalResolve(parent, args, ctx, info);
-          }
-
-          for (const rule of rules) {
-            log(`Executing rule for ${typeName}.${fieldName}`);
-
-            const allowed = await executeRule(rule, parent, args, ctx, info);
-
-            if (!allowed) {
-              log(`Rule denied access to ${typeName}.${fieldName}`);
-              throw new ForbiddenError(`Access denied to ${typeName}.${fieldName}`);
-            }
-          }
-
-          await authorizeQueryPaths(permissions, defaultPolicy, schema, query, args, ctx, info);
-          log(`Access granted to ${typeName}.${fieldName}`);
-
-          return originalResolve(parent, args, ctx, info);
-        };
+        const resolver = createFieldResolver(schema, typeName, fieldName, rules, query, field.resolve || defaultFieldResolver);
+        field.resolve = resolver;
+        wrappers.set(field, resolver);
       }
     }
 
     processedSchemas.add(schema);
+    authorizedSchemas.add(schema);
   };
 
   return {