@stonecrop/casl-middleware 0.7.0

package/dist/casl_middleware.tsbuildinfo

@@ -0,0 +1 @@
+{"version":"5.9.3"}

package/dist/src/index.d.ts

@@ -0,0 +1,6 @@
+export { createAbility, detectSubjectType } from './middleware/ability';
+export type { AppAbility } from './middleware/ability';
+export { createCaslMiddleware } from './middleware/graphql';
+export { pglCaslPlugin } from './middleware/postgraphile';
+export type { User, Context, MiddlewareOptions, FieldPermission, ResolverFn, MiddlewareFn, PluginOptions, AbilityResponse, CreateAbilityInput, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzD,YAAY,EACX,IAAI,EACJ,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,YAAY,EACZ,aAAa,EACb,eAAe,EACf,kBAAkB,GAClB,MAAM,SAAS,CAAA"}

package/dist/src/index.js

@@ -0,0 +1,3 @@
+export { createAbility, detectSubjectType } from './middleware/ability';
+export { createCaslMiddleware } from './middleware/graphql';
+export { pglCaslPlugin } from './middleware/postgraphile';

package/dist/src/middleware/ability.d.ts

@@ -0,0 +1,55 @@
+import { PureAbility } from '@casl/ability';
+import type { Context } from '../types';
+/**
+ * Detects the subject type from an object for CASL authorization
+ * @param object - The object to detect the subject type from
+ * @returns The subject type string
+ * @public
+ */
+export declare const detectSubjectType: (object: any) => string;
+/**
+ * CASL ability type for authorization with flexible subject types
+ * @public
+ */
+export type AppAbility = PureAbility<[string, any], any>;
+/**
+ * Function type for building user abilities
+ * @public
+ */
+export type AbilityBuilderFunction = (user?: Context['user']) => Promise<AppAbility> | AppAbility;
+/**
+ * Default ability builder - only provides minimal public access
+ */
+export declare const defaultAbilityBuilder: (user?: Context["user"]) => AppAbility;
+/**
+ * Create ability using a provided builder function
+ * @param user - User information for building the ability
+ * @param builderFn - Function to build the ability
+ * @returns Promise resolving to the created ability
+ * @public
+ */
+export declare const createAbility: (user?: Context["user"], builderFn?: AbilityBuilderFunction) => Promise<AppAbility>;
+/**
+ * Factory function for creating custom ability builders
+ */
+export declare const createDatabaseAbilityBuilder: (fetchRules: (userId?: string) => Promise<any[]>) => AbilityBuilderFunction;
+/**
+ * Create an ability builder from static configuration
+ */
+export declare const createConfigBasedAbilityBuilder: (config: {
+    roles: Record<string, Array<{
+        action: string | string[];
+        subject: string;
+        fields?: string | string[];
+        conditions?: any;
+        inverted?: boolean;
+    }>>;
+    defaultRules?: Array<{
+        action: string | string[];
+        subject: string;
+        fields?: string | string[];
+        conditions?: any;
+    }>;
+}) => AbilityBuilderFunction;
+export declare const createAbilityFactory: <T extends PureAbility>(builderFn: (user?: Context["user"]) => T) => ((user?: Context["user"]) => T);
+//# sourceMappingURL=ability.d.ts.map

package/dist/src/middleware/ability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability.d.ts","sourceRoot":"","sources":["../../../src/middleware/ability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,WAAW,EAAgE,MAAM,eAAe,CAAA;AAEzH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,GAAG,KAAG,MAc/C,CAAA;AAwBD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;AAExD;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;AAIjG;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,OAAO,CAAC,MAAM,CAAC,KAAG,UAU9D,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GACzB,OAAO,OAAO,CAAC,MAAM,CAAC,EACtB,YAAW,sBAA8C,KACvD,OAAO,CAAC,UAAU,CAEpB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,4BAA4B,GACxC,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,KAC7C,sBAwBF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,QAAQ;IACvD,KAAK,EAAE,MAAM,CACZ,MAAM,EACN,KAAK,CAAC;QACL,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACzB,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC1B,UAAU,CAAC,EAAE,GAAG,CAAA;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;KAClB,CAAC,CACF,CAAA;IACD,YAAY,CAAC,EAAE,KAAK,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACzB,OAAO,EAAE,MAAM,CAAA;QACf,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC1B,UAAU,CAAC,EAAE,GAAG,CAAA;KAChB,CAAC,CAAA;CACF,KAAG,sBA0CH,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,WAAW,EACzD,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KACtC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAEhC,CAAA"}

package/dist/src/middleware/ability.js

@@ -0,0 +1,139 @@
+import { AbilityBuilder, PureAbility } from '@casl/ability';
+/**
+ * Detects the subject type from an object for CASL authorization
+ * @param object - The object to detect the subject type from
+ * @returns The subject type string
+ * @public
+ */
+export const detectSubjectType = (object) => {
+    // Handle CASL's subject() helper objects
+    if (object && typeof object === 'object') {
+        // CASL uses __caslSubjectType__ property
+        if ('__caslSubjectType__' in object) {
+            return object.__caslSubjectType__;
+        }
+        // Fallback to other type indicators
+        if (object.type)
+            return object.type;
+        if (object.constructor?.name && object.constructor.name !== 'Object') {
+            return object.constructor.name;
+        }
+    }
+    return 'Unknown';
+};
+// Simple field matcher - checks if a field is in the restricted list
+const fieldMatcher = fields => field => {
+    if (!fields || !field)
+        return false;
+    if (Array.isArray(fields)) {
+        return fields.includes(field);
+    }
+    return fields === field;
+};
+// Simple conditions matcher - basic equality check
+const conditionsMatcher = conditions => object => {
+    if (!conditions || !object)
+        return true;
+    return Object.keys(conditions).every(key => {
+        const conditionValue = conditions[key];
+        const objectValue = object[key];
+        // Simple equality check
+        return objectValue === conditionValue;
+    });
+};
+const Ability = PureAbility;
+/**
+ * Default ability builder - only provides minimal public access
+ */
+export const defaultAbilityBuilder = (user) => {
+    const { can, build } = new AbilityBuilder(Ability);
+    can('read', 'Query');
+    return build({
+        detectSubjectType,
+        fieldMatcher,
+        conditionsMatcher,
+    });
+};
+/**
+ * Create ability using a provided builder function
+ * @param user - User information for building the ability
+ * @param builderFn - Function to build the ability
+ * @returns Promise resolving to the created ability
+ * @public
+ */
+export const createAbility = async (user, builderFn = defaultAbilityBuilder) => {
+    return await builderFn(user);
+};
+/**
+ * Factory function for creating custom ability builders
+ */
+export const createDatabaseAbilityBuilder = (fetchRules) => {
+    return async (user) => {
+        const { can, cannot, build } = new AbilityBuilder(Ability);
+        if (user?.id) {
+            const rules = await fetchRules(user.id);
+            rules.forEach(rule => {
+                if (rule.inverted) {
+                    cannot(rule.action, rule.subject, rule.fields, rule.conditions);
+                }
+                else {
+                    can(rule.action, rule.subject, rule.fields, rule.conditions);
+                }
+            });
+        }
+        else {
+            can('read', 'Query');
+        }
+        return build({
+            detectSubjectType,
+            fieldMatcher,
+            conditionsMatcher,
+        });
+    };
+};
+/**
+ * Create an ability builder from static configuration
+ */
+export const createConfigBasedAbilityBuilder = (config) => {
+    return (user) => {
+        const { can, cannot, build } = new AbilityBuilder(Ability);
+        // Apply default rules
+        if (config.defaultRules) {
+            config.defaultRules.forEach(rule => {
+                can(rule.action, rule.subject, rule.fields, rule.conditions);
+            });
+        }
+        // Apply role-based rules
+        if (user?.roles) {
+            user.roles.forEach(role => {
+                const rules = config.roles[role];
+                if (rules) {
+                    rules.forEach(rule => {
+                        // Process template variables in conditions
+                        let processedConditions = rule.conditions;
+                        if (processedConditions && user.id) {
+                            const condStr = JSON.stringify(processedConditions);
+                            if (condStr.includes('{{userId}}')) {
+                                processedConditions = JSON.parse(condStr.replace(/{{userId}}/g, user.id));
+                            }
+                        }
+                        if (rule.inverted) {
+                            cannot(rule.action, rule.subject, rule.fields, processedConditions);
+                        }
+                        else {
+                            can(rule.action, rule.subject, rule.fields, processedConditions);
+                        }
+                    });
+                }
+            });
+        }
+        return build({
+            detectSubjectType,
+            fieldMatcher,
+            conditionsMatcher,
+        });
+    };
+};
+export const createAbilityFactory = (builderFn) => {
+    return (user) => builderFn(user);
+};

package/dist/src/middleware/graphql.d.ts

@@ -0,0 +1,11 @@
+import { GraphQLResolveInfo } from 'graphql';
+import { Context, MiddlewareOptions, ResolverFn } from '../types';
+/**
+ * Creates CASL authorization middleware for GraphQL resolvers
+ * @param options - Configuration options for the middleware
+ * @returns Middleware function that wraps resolvers with authorization checks
+ * @public
+ */
+export declare const createCaslMiddleware: (options?: MiddlewareOptions) => (resolve: ResolverFn, root: any, args: any, context: Context, info: GraphQLResolveInfo) => Promise<any>;
+export declare const combineMiddlewares: (...middlewares: any[]) => (resolve: ResolverFn, root: any, args: any, context: any, info: any) => any;
+//# sourceMappingURL=graphql.d.ts.map

package/dist/src/middleware/graphql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql.d.ts","sourceRoot":"","sources":["../../../src/middleware/graphql.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAE1D,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAyDjE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAS,iBAAsB,MAclE,SAAS,UAAU,EACnB,MAAM,GAAG,EACT,MAAM,GAAG,EACT,SAAS,OAAO,EAChB,MAAM,kBAAkB,KACtB,OAAO,CAAC,GAAG,CA4Dd,CAAA;AAGD,eAAO,MAAM,kBAAkB,GAAI,GAAG,aAAa,GAAG,EAAE,MAC/C,SAAS,UAAU,EAAE,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,SAAS,GAAG,EAAE,MAAM,GAAG,QAO1E,CAAA"}

package/dist/src/middleware/graphql.js

@@ -0,0 +1,120 @@
+import { subject } from '@casl/ability';
+import { GraphQLError } from 'graphql';
+import { parse, visit } from 'graphql/language';
+import { createAbility, defaultAbilityBuilder } from './ability';
+// Helper to extract operation name from GraphQL info
+const getOperationName = (info) => {
+    return info.operation.operation.toLowerCase();
+};
+// Helper to get full field path
+const getFieldPath = (info) => {
+    return info.path.typename ? `${info.path.typename}.${info.path.key}` : String(info.path.key);
+};
+// Parse GraphQL query to extract accessed fields
+const extractAccessedFields = (query) => {
+    const fields = [];
+    try {
+        const ast = parse(query);
+        visit(ast, {
+            Field: {
+                enter(node) {
+                    if (node.name.value !== '__typename') {
+                        fields.push(node.name.value);
+                    }
+                },
+            },
+        });
+    }
+    catch (error) {
+        console.error('Failed to parse GraphQL query:', error);
+    }
+    return fields;
+};
+// Check if ability allows the operation
+const checkPermission = (context, action, subjectName, conditions) => {
+    if (!context.ability) {
+        return false;
+    }
+    try {
+        // Only use subject helper if we have specific conditions to check
+        // (not just resolver args, but actual CASL conditions)
+        if (conditions && typeof conditions === 'object') {
+            return context.ability.can(action, subject(subjectName, conditions));
+        }
+        else {
+            // Simple check without conditions - just action and subject type
+            return context.ability.can(action, subjectName);
+        }
+    }
+    catch (error) {
+        console.error('Permission check failed:', error);
+        return false;
+    }
+};
+/**
+ * Creates CASL authorization middleware for GraphQL resolvers
+ * @param options - Configuration options for the middleware
+ * @returns Middleware function that wraps resolvers with authorization checks
+ * @public
+ */
+export const createCaslMiddleware = (options = {}) => {
+    const { subjectMap = {}, actionMap = {
+        query: 'read',
+        mutation: 'update',
+        subscription: 'read',
+    }, fieldPermissions = {}, abilityBuilder = defaultAbilityBuilder, debug = false, } = options;
+    return async (resolve, root, args, context, info) => {
+        // Create ability if not already in context
+        if (!context.ability) {
+            context.ability = await createAbility(context.user, abilityBuilder);
+        }
+        const operation = getOperationName(info);
+        const fieldPath = getFieldPath(info);
+        const action = actionMap[operation] || operation;
+        // Get subject from map or default to type name
+        const subjectType = info.parentType.name;
+        const subjectName = subjectMap[subjectType] || subjectType;
+        if (debug) {
+            console.log(`Checking permission: ${action} on ${subjectName} at ${fieldPath}`);
+        }
+        // Check field-level permissions if defined
+        if (fieldPermissions[fieldPath]) {
+            const permissions = fieldPermissions[fieldPath];
+            const allowed = permissions.some(permission => 
+            // Don't pass resolver args here - only use them if the permission defines conditions
+            checkPermission(context, permission.action, permission.subject, permission.conditions));
+            if (!allowed) {
+                throw new GraphQLError(`Access denied for field ${fieldPath}`);
+            }
+        }
+        // Check operation-level permission
+        // Don't pass resolver args as conditions - they're not CASL conditions
+        const allowed = checkPermission(context, action, subjectName);
+        if (!allowed) {
+            throw new GraphQLError(`Access denied for ${action} on ${subjectName}`);
+        }
+        // Additional checks for mutations with input fields
+        if (operation === 'mutation' && args.input) {
+            const querySource = info.operation.loc?.source.body;
+            if (querySource) {
+                const accessedFields = extractAccessedFields(querySource);
+                for (const field of accessedFields) {
+                    // Check field-level update permissions if needed
+                    const fieldAllowed = checkPermission(context, 'update', subjectName, { field });
+                    if (!fieldAllowed && debug) {
+                        console.warn(`Warning: Field ${field} update not explicitly allowed`);
+                    }
+                }
+            }
+        }
+        // Call the resolver
+        return resolve(root, args, context, info);
+    };
+};
+// Utility function to combine multiple middlewares
+export const combineMiddlewares = (...middlewares) => {
+    return (resolve, root, args, context, info) => {
+        const chain = middlewares.reduceRight((next, middleware) => () => middleware(next, root, args, context, info), () => resolve(root, args, context, info));
+        return chain();
+    };
+};

package/dist/src/middleware/introspection.d.ts

@@ -0,0 +1,71 @@
+import type { Context, MiddlewareOptions } from '../types';
+export interface IntrospectionConfig {
+    /**
+     * Whether to allow introspection queries at all
+     * @default true in development, false in production
+     */
+    enabled?: boolean;
+    /**
+     * Roles that are allowed to introspect the schema
+     * If undefined, all authenticated users can introspect
+     */
+    allowedRoles?: string[];
+    /**
+     * Allow unauthenticated introspection
+     * @default false
+     */
+    allowAnonymous?: boolean;
+    /**
+     * Custom function to determine if introspection is allowed
+     */
+    customCheck?: (context: Context) => boolean | Promise<boolean>;
+    /**
+     * Types to hide from introspection based on user permissions
+     * Maps type names to required permissions
+     */
+    typePermissions?: Record<string, {
+        action: string;
+        subject: string;
+    }>;
+    /**
+     * Fields to hide from introspection based on user permissions
+     * Maps "Type.field" to required permissions
+     */
+    fieldPermissions?: Record<string, {
+        action: string;
+        subject: string;
+    }>;
+}
+/**
+ * Middleware to restrict GraphQL introspection based on user permissions
+ */
+export declare const createIntrospectionMiddleware: (config?: IntrospectionConfig) => (resolve: any, root: any, args: any, context: Context, info: any) => Promise<any>;
+/**
+ * Postgraphile plugin for introspection control
+ */
+export declare const createPostgraphileIntrospectionPlugin: (config: IntrospectionConfig) => {
+    name: string;
+    version: string;
+    grafast: {
+        hooks: {
+            GraphQLSchema(schema: any): any;
+        };
+    };
+};
+/**
+ * Utility to create ability rules for introspection
+ */
+export declare const createIntrospectionAbilityRules: (user?: {
+    roles?: string[];
+}) => Array<{
+    action: string;
+    subject: string;
+}>;
+/**
+ * Example: Combine introspection with CASL middleware
+ */
+export declare const createSecureGraphQLMiddleware: (options: {
+    casl?: MiddlewareOptions;
+    introspection?: IntrospectionConfig;
+}) => (resolve: any, root: any, args: any, context: any, info: any) => any;
+//# sourceMappingURL=introspection.d.ts.map

package/dist/src/middleware/introspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspection.d.ts","sourceRoot":"","sources":["../../../src/middleware/introspection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAE1D,MAAM,WAAW,mBAAmB;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IAEjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IAEvB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IAExB;;OAEG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE9D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAErE;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtE;AAED;;GAEG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAQ,mBAAwB,MAU/D,SAAS,GAAG,EAAE,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,SAAS,OAAO,EAAE,MAAM,GAAG,iBA8D7E,CAAA;AAyDD;;GAEG;AACH,eAAO,MAAM,qCAAqC,GAAI,QAAQ,mBAAmB;;;;;kCAQvD,GAAG;;;CAW5B,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,OAAO;IACtD,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB,KAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAgC5C,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS;IACtD,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACxB,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACnC,MASQ,SAAS,GAAG,EAAE,MAAM,GAAG,EAAE,MAAM,GAAG,EAAE,SAAS,GAAG,EAAE,MAAM,GAAG,QAOnE,CAAA"}

package/dist/src/middleware/introspection.js

@@ -0,0 +1,169 @@
+import { GraphQLError } from 'graphql';
+/**
+ * Middleware to restrict GraphQL introspection based on user permissions
+ */
+export const createIntrospectionMiddleware = (config = {}) => {
+    const { enabled = process.env.NODE_ENV !== 'production', allowedRoles, allowAnonymous = false, customCheck, typePermissions = {}, fieldPermissions = {}, } = config;
+    return async (resolve, root, args, context, info) => {
+        // Check if this is an introspection query
+        const isIntrospection = info.fieldName === '__schema' ||
+            info.fieldName === '__type' ||
+            info.parentType?.name === '__Schema' ||
+            info.parentType?.name === '__Type';
+        if (!isIntrospection) {
+            // Not an introspection query, continue normally
+            return resolve(root, args, context, info);
+        }
+        // Check if introspection is enabled
+        if (!enabled) {
+            throw new GraphQLError('Introspection is disabled');
+        }
+        // Custom check function
+        if (customCheck) {
+            const allowed = await customCheck(context);
+            if (!allowed) {
+                throw new GraphQLError('Introspection not allowed');
+            }
+        }
+        // Check authentication
+        if (!context.user && !allowAnonymous) {
+            throw new GraphQLError('Authentication required for introspection');
+        }
+        // Check role-based access
+        if (allowedRoles && allowedRoles.length > 0) {
+            const userRoles = context.user?.roles || [];
+            const hasAllowedRole = allowedRoles.some(role => userRoles.includes(role));
+            if (!hasAllowedRole) {
+                throw new GraphQLError('Insufficient permissions for introspection');
+            }
+        }
+        // Check CASL-based permissions
+        if (context.ability) {
+            // Check if user can read schema
+            if (!context.ability.can('read', '__Schema')) {
+                throw new GraphQLError('Permission denied for schema introspection');
+            }
+        }
+        // Get the result
+        let result = await resolve(root, args, context, info);
+        // Filter the result based on permissions
+        if (result && (typePermissions || fieldPermissions)) {
+            result = filterIntrospectionResult(result, context, {
+                typePermissions,
+                fieldPermissions,
+            });
+        }
+        return result;
+    };
+};
+/**
+ * Filter introspection results based on user permissions
+ */
+function filterIntrospectionResult(result, context, config) {
+    if (!context.ability)
+        return result;
+    // Filter __schema result
+    if (result && result.types) {
+        result.types = result.types.filter((type) => {
+            // Check if user has permission to see this type
+            const permission = config.typePermissions?.[type.name];
+            if (permission) {
+                return context.ability.can(permission.action, permission.subject);
+            }
+            return true; // Show types without specific permissions
+        });
+        // Filter fields within types
+        result.types.forEach((type) => {
+            if (type.fields) {
+                type.fields = type.fields.filter((field) => {
+                    const fieldKey = `${type.name}.${field.name}`;
+                    const permission = config.fieldPermissions?.[fieldKey];
+                    if (permission) {
+                        return context.ability.can(permission.action, permission.subject);
+                    }
+                    return true;
+                });
+            }
+        });
+    }
+    // Filter __type result
+    if (result && result.fields) {
+        const typeName = result.name;
+        result.fields = result.fields.filter((field) => {
+            const fieldKey = `${typeName}.${field.name}`;
+            const permission = config.fieldPermissions?.[fieldKey];
+            if (permission) {
+                return context.ability.can(permission.action, permission.subject);
+            }
+            return true;
+        });
+    }
+    return result;
+}
+/**
+ * Postgraphile plugin for introspection control
+ */
+export const createPostgraphileIntrospectionPlugin = (config) => {
+    return {
+        name: 'IntrospectionControlPlugin',
+        version: '1.0.0',
+        // Disable introspection in GraphiQL based on config
+        grafast: {
+            hooks: {
+                GraphQLSchema(schema) {
+                    if (!config.enabled) {
+                        // Remove introspection from schema
+                        // This is a simplified approach - real implementation would be more complex
+                        console.warn('Introspection control in Postgraphile requires custom implementation');
+                    }
+                    return schema;
+                },
+            },
+        },
+    };
+};
+/**
+ * Utility to create ability rules for introspection
+ */
+export const createIntrospectionAbilityRules = (user) => {
+    const rules = [];
+    if (!user) {
+        // Anonymous users cannot introspect
+        return rules;
+    }
+    const roles = user.roles || [];
+    // Admins can introspect everything
+    if (roles.includes('admin')) {
+        rules.push({ action: 'read', subject: '__Schema' });
+        rules.push({ action: 'read', subject: '__Type' });
+        return rules;
+    }
+    // Developers can introspect
+    if (roles.includes('developer')) {
+        rules.push({ action: 'read', subject: '__Schema' });
+        rules.push({ action: 'read', subject: '__Type' });
+        return rules;
+    }
+    // Regular users get limited introspection
+    if (roles.includes('user')) {
+        // They can see the schema but not all types
+        rules.push({ action: 'read', subject: '__Schema' });
+        // Specific types they can see would be added here
+    }
+    return rules;
+};
+/**
+ * Example: Combine introspection with CASL middleware
+ */
+export const createSecureGraphQLMiddleware = (options) => {
+    const middlewares = [];
+    // Add introspection control
+    if (options.introspection) {
+        middlewares.push(createIntrospectionMiddleware(options.introspection));
+    }
+    // Combine all middlewares
+    return (resolve, root, args, context, info) => {
+        const chain = middlewares.reduceRight((next, middleware) => () => middleware(next, root, args, context, info), () => resolve(root, args, context, info));
+        return chain();
+    };
+};