@theguild/federation-composition 0.20.2 → 0.21.0

package/cjs/subgraph/state.js

@@ -9,6 +9,7 @@ const graphql_1 = require("graphql");
 const printer_js_1 = require("../graphql/printer.js");
 const federation_js_1 = require("../specifications/federation.js");
 const helpers_js_1 = require("./helpers.js");
+const auth_js_1 = require("../utils/auth.js");
 var TypeKind;
 (function (TypeKind) {
     TypeKind["OBJECT"] = "OBJECT";
@@ -637,10 +638,12 @@ function scalarTypeFactory(state) {
             getOrCreateScalarType(state, typeName).authenticated = true;
         },
         setPolicies(typeName, policies) {
-            getOrCreateScalarType(state, typeName).policies.push(...policies);
+            const existing = getOrCreateScalarType(state, typeName);
+            existing.policies = (0, auth_js_1.mergeScopePolicies)(existing.policies, policies);
         },
         setScopes(typeName, scopes) {
-            getOrCreateScalarType(state, typeName).scopes.push(...scopes);
+            const existing = getOrCreateScalarType(state, typeName);
+            existing.scopes = (0, auth_js_1.mergeScopePolicies)(existing.scopes, scopes);
         },
         setCost(typeName, cost) {
             getOrCreateScalarType(state, typeName).cost = cost;
@@ -719,23 +722,16 @@ function objectTypeFactory(state, renameObject, interfaceTypeBuilder, isInterfac
             objectType.inaccessible = true;
         },
         setAuthenticated(typeName) {
-            if (isInterfaceObject(typeName)) {
-                return interfaceTypeBuilder.setAuthenticated(typeName);
-            }
             const objectType = getOrCreateObjectType(state, renameObject, typeName);
             objectType.authenticated = true;
         },
         setPolicies(typeName, policies) {
-            if (isInterfaceObject(typeName)) {
-                return interfaceTypeBuilder.setPolicies(typeName, policies);
-            }
-            getOrCreateObjectType(state, renameObject, typeName).policies.push(...policies);
+            const existing = getOrCreateObjectType(state, renameObject, typeName);
+            existing.policies = (0, auth_js_1.mergeScopePolicies)(existing.policies, policies);
         },
         setScopes(typeName, scopes) {
-            if (isInterfaceObject(typeName)) {
-                return interfaceTypeBuilder.setScopes(typeName, scopes);
-            }
-            getOrCreateObjectType(state, renameObject, typeName).scopes.push(...scopes);
+            const existing = getOrCreateObjectType(state, renameObject, typeName);
+            existing.scopes = (0, auth_js_1.mergeScopePolicies)(existing.scopes, scopes);
         },
         setCost(typeName, cost) {
             if (isInterfaceObject(typeName)) {
@@ -812,13 +808,15 @@ function objectTypeFactory(state, renameObject, interfaceTypeBuilder, isInterfac
                 if (isInterfaceObject(typeName)) {
                     return interfaceTypeBuilder.field.setPolicies(typeName, fieldName, policies);
                 }
-                getOrCreateObjectField(state, renameObject, typeName, fieldName).policies.push(...policies);
+                let existing = getOrCreateObjectField(state, renameObject, typeName, fieldName);
+                existing.policies = (0, auth_js_1.mergeScopePolicies)(existing.policies, policies);
             },
             setScopes(typeName, fieldName, scopes) {
                 if (isInterfaceObject(typeName)) {
                     return interfaceTypeBuilder.field.setScopes(typeName, fieldName, scopes);
                 }
-                getOrCreateObjectField(state, renameObject, typeName, fieldName).scopes.push(...scopes);
+                let existing = getOrCreateObjectField(state, renameObject, typeName, fieldName);
+                existing.scopes = (0, auth_js_1.mergeScopePolicies)(existing.scopes, scopes);
             },
             setCost(typeName, fieldName, cost) {
                 if (isInterfaceObject(typeName)) {
@@ -983,16 +981,6 @@ function interfaceTypeFactory(state) {
             const objectType = getOrCreateInterfaceType(state, typeName);
             objectType.inaccessible = true;
         },
-        setAuthenticated(typeName) {
-            const t = getOrCreateInterfaceType(state, typeName);
-            t.authenticated = true;
-        },
-        setPolicies(typeName, policies) {
-            getOrCreateInterfaceType(state, typeName).policies.push(...policies);
-        },
-        setScopes(typeName, scopes) {
-            getOrCreateInterfaceType(state, typeName).scopes.push(...scopes);
-        },
         setTag(typeName, tag) {
             getOrCreateInterfaceType(state, typeName).tags.add(tag);
         },
@@ -1021,10 +1009,12 @@ function interfaceTypeFactory(state) {
                     true;
             },
             setPolicies(typeName, fieldName, policies) {
-                getOrCreateInterfaceField(state, typeName, fieldName).policies.push(...policies);
+                const existing = getOrCreateInterfaceField(state, typeName, fieldName);
+                existing.policies = (0, auth_js_1.mergeScopePolicies)(existing.policies, policies);
             },
             setScopes(typeName, fieldName, scopes) {
-                getOrCreateInterfaceField(state, typeName, fieldName).scopes.push(...scopes);
+                const existing = getOrCreateInterfaceField(state, typeName, fieldName);
+                existing.scopes = (0, auth_js_1.mergeScopePolicies)(existing.scopes, scopes);
             },
             setCost(typeName, fieldName, cost) {
                 getOrCreateInterfaceField(state, typeName, fieldName).cost = cost;
@@ -1196,10 +1186,12 @@ function enumTypeFactory(state) {
             getOrCreateEnumType(state, typeName).authenticated = true;
         },
         setPolicies(typeName, policies) {
-            getOrCreateEnumType(state, typeName).policies.push(...policies);
+            const existing = getOrCreateEnumType(state, typeName);
+            existing.policies = (0, auth_js_1.mergeScopePolicies)(existing.policies, policies);
         },
         setScopes(typeName, scopes) {
-            getOrCreateEnumType(state, typeName).scopes.push(...scopes);
+            const existing = getOrCreateEnumType(state, typeName);
+            existing.scopes = (0, auth_js_1.mergeScopePolicies)(existing.scopes, scopes);
         },
         setCost(typeName, cost) {
             getOrCreateEnumType(state, typeName).cost = cost;
@@ -1375,9 +1367,6 @@ function getOrCreateInterfaceType(state, typeName) {
         extension: false,
         keys: [],
         inaccessible: false,
-        authenticated: false,
-        policies: [],
-        scopes: [],
         tags: new Set(),
         interfaces: new Set(),
         implementedBy: new Set(),

package/cjs/subgraph/validation/rules/elements/authenticated.js

@@ -33,6 +33,15 @@ function AuthenticatedRule(context) {
                     if (!typeDef) {
                         throw new Error("Could not find the parent type of the field annotated with @authenticated");
                     }
+                    if (typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_DEFINITION ||
+                        typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_EXTENSION) {
+                        context.reportError(new graphql_1.GraphQLError(`Invalid use of @authenticated on field "${typeDef.name.value}.${parent.name.value}": @authenticated cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
                     if (typeDef.kind === graphql_1.Kind.OBJECT_TYPE_DEFINITION ||
                         typeDef.kind === graphql_1.Kind.OBJECT_TYPE_EXTENSION) {
                         context.stateBuilder.objectType.field.setAuthenticated(typeDef.name.value, parent.name.value);
@@ -41,12 +50,24 @@ function AuthenticatedRule(context) {
                 }
                 case graphql_1.Kind.OBJECT_TYPE_DEFINITION:
                 case graphql_1.Kind.OBJECT_TYPE_EXTENSION:
+                    if (context.stateBuilder.isInterfaceObject(parent.name.value)) {
+                        context.reportError(new graphql_1.GraphQLError(`Invalid use of @authenticated on interface object "${parent.name.value}": @authenticated cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
                     context.stateBuilder.objectType.setAuthenticated(parent.name.value);
                     break;
                 case graphql_1.Kind.INTERFACE_TYPE_DEFINITION:
                 case graphql_1.Kind.INTERFACE_TYPE_DEFINITION:
-                    context.stateBuilder.interfaceType.setAuthenticated(parent.name.value);
-                    break;
+                    context.reportError(new graphql_1.GraphQLError(`Invalid use of @authenticated on interface "${parent.name.value}": @authenticated cannot be applied on interfaces, interface fields and interface objects`, {
+                        extensions: {
+                            code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                        },
+                    }));
+                    return;
                 case graphql_1.Kind.SCALAR_TYPE_DEFINITION:
                 case graphql_1.Kind.SCALAR_TYPE_EXTENSION:
                     context.stateBuilder.scalarType.setAuthenticated(parent.name.value);

package/cjs/subgraph/validation/rules/elements/cost.js

@@ -58,7 +58,12 @@ function CostRule(context) {
                     }
                     if (typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_DEFINITION ||
                         typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_EXTENSION) {
-                        context.stateBuilder.interfaceType.field.setCost(typeDef.name.value, parent.name.value, weight);
+                        context.reportError(new graphql_1.GraphQLError(`@cost cannot be applied to interface "${typeDef.name.value}.${parent.name.value}"`, {
+                            extensions: {
+                                code: "COST_APPLIED_TO_INTERFACE_FIELD",
+                            },
+                        }));
+                        return;
                     }
                     break;
                 }
@@ -89,7 +94,12 @@ function CostRule(context) {
                         if (!argDef) {
                             throw new Error("Could not find the argument annotated with @cost");
                         }
-                        context.stateBuilder.interfaceType.field.arg.setCost(typeDef.name.value, fieldDef.name.value, argDef.name.value, weight);
+                        context.reportError(new graphql_1.GraphQLError(`@cost cannot be applied to interface "${typeDef.name.value}.${fieldDef.name.value}" argument "${argDef.name.value}"`, {
+                            extensions: {
+                                code: "COST_APPLIED_TO_INTERFACE_FIELD",
+                            },
+                        }));
+                        return;
                     }
                     break;
                 case graphql_1.Kind.OBJECT_TYPE_DEFINITION:

package/cjs/subgraph/validation/rules/elements/list-size.js

@@ -169,29 +169,29 @@ function ListSizeRule(context) {
                         const outputType = (0, helpers_js_1.namedTypeFromTypeNode)(fieldDef.type);
                         const targetType = knownObjectsAndInterfaces.get(outputType.name.value);
                         if (!targetType) {
-                            context.reportError(new graphql_1.GraphQLError(`${coordinate} has @listSize(sizedFields:) applied, but the output type is not an object`, {
+                            context.reportError(new graphql_1.GraphQLError(`${coordinate} has @listSize(sizedFields:) applied, but the output type is not a composite type`, {
                                 extensions: {
                                     code: "LIST_SIZE_INVALID_SIZED_FIELD",
                                 },
                             }));
                             return;
                         }
-                        const nonIntFields = [];
+                        const nonListFields = [];
                         const nonExistingFields = [];
                         for (const sizedField of sizedFields) {
                             const targetField = targetType.fields?.find((f) => f.name.value === sizedField);
                             if (!targetField) {
                                 nonExistingFields.push(sizedField);
                             }
-                            else if (!isIntTypeOrNullableIntType(targetField.type)) {
-                                nonIntFields.push(sizedField);
+                            else if (!isListType(targetField.type)) {
+                                nonListFields.push(sizedField);
                             }
                         }
-                        if (nonIntFields.length || nonExistingFields.length) {
-                            nonIntFields.forEach((fieldName) => {
-                                context.reportError(new graphql_1.GraphQLError(`${coordinate} references "${fieldName}" field in @listSize(sizedFields:) argument that is not an integer.`, {
+                        if (nonListFields.length || nonExistingFields.length) {
+                            nonListFields.forEach((fieldName) => {
+                                context.reportError(new graphql_1.GraphQLError(`${coordinate} references "${fieldName}" field in @listSize(sizedFields:) argument that is not a list.`, {
                                     extensions: {
-                                        code: "LIST_SIZE_INVALID_SIZED_FIELD",
+                                        code: "LIST_SIZE_APPLIED_TO_NON_LIST",
                                     },
                                 }));
                             });
@@ -238,6 +238,7 @@ function ListSizeRule(context) {
                     if (typeDef.kind === graphql_1.Kind.OBJECT_TYPE_DEFINITION ||
                         typeDef.kind === graphql_1.Kind.OBJECT_TYPE_EXTENSION) {
                         context.stateBuilder.objectType.field.setListSize(typeDef.name.value, parent.name.value, {
+                            printRequireOneSlicingArgument: false,
                             assumedSize,
                             slicingArguments,
                             sizedFields,
@@ -247,6 +248,7 @@ function ListSizeRule(context) {
                     if (typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_DEFINITION ||
                         typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_EXTENSION) {
                         context.stateBuilder.interfaceType.field.setListSize(typeDef.name.value, parent.name.value, {
+                            printRequireOneSlicingArgument: false,
                             assumedSize,
                             slicingArguments,
                             sizedFields,

package/cjs/subgraph/validation/rules/elements/policy.js

@@ -55,21 +55,41 @@ function PolicyRule(context) {
                     if (!typeDef) {
                         throw new Error("Could not find the parent type of the field annotated with @policy");
                     }
-                    if ((typeDef.kind === graphql_1.Kind.OBJECT_TYPE_DEFINITION ||
-                        typeDef.kind === graphql_1.Kind.OBJECT_TYPE_EXTENSION) &&
-                        !context.stateBuilder.isInterfaceObject(typeDef.name.value)) {
+                    if (typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_DEFINITION ||
+                        typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_EXTENSION) {
+                        context.reportError(new graphql_1.GraphQLError(`Invalid use of @policy on field "${typeDef.name.value}.${parent.name.value}": @policy cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
+                    if (typeDef.kind === graphql_1.Kind.OBJECT_TYPE_DEFINITION ||
+                        typeDef.kind === graphql_1.Kind.OBJECT_TYPE_EXTENSION) {
                         context.stateBuilder.objectType.field.setPolicies(typeDef.name.value, parent.name.value, policies);
                     }
                     break;
                 }
                 case graphql_1.Kind.OBJECT_TYPE_DEFINITION:
                 case graphql_1.Kind.OBJECT_TYPE_EXTENSION:
+                    if (context.stateBuilder.isInterfaceObject(parent.name.value)) {
+                        context.reportError(new graphql_1.GraphQLError(`Invalid use of @policy on interface object "${parent.name.value}": @policy cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
                     context.stateBuilder.objectType.setPolicies(parent.name.value, policies);
                     break;
                 case graphql_1.Kind.INTERFACE_TYPE_DEFINITION:
                 case graphql_1.Kind.INTERFACE_TYPE_DEFINITION:
-                    context.stateBuilder.interfaceType.setPolicies(parent.name.value, policies);
-                    break;
+                    context.reportError(new graphql_1.GraphQLError(`Invalid use of @policy on interface "${parent.name.value}": @policy cannot be applied on interfaces, interface fields and interface objects`, {
+                        extensions: {
+                            code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                        },
+                    }));
+                    return;
                 case graphql_1.Kind.SCALAR_TYPE_DEFINITION:
                 case graphql_1.Kind.SCALAR_TYPE_EXTENSION:
                     context.stateBuilder.scalarType.setPolicies(parent.name.value, policies);

package/cjs/subgraph/validation/rules/elements/requires-scopes.js

@@ -55,6 +55,15 @@ function RequiresScopesRule(context) {
                     if (!typeDef) {
                         throw new Error("Could not find the parent type of the field annotated with @requiresScopes");
                     }
+                    if (typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_DEFINITION ||
+                        typeDef.kind === graphql_1.Kind.INTERFACE_TYPE_EXTENSION) {
+                        context.reportError(new graphql_1.GraphQLError(`Invalid use of @requiresScopes on field "${typeDef.name.value}.${parent.name.value}": @requiresScopes cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
                     if (typeDef.kind === graphql_1.Kind.OBJECT_TYPE_DEFINITION ||
                         typeDef.kind === graphql_1.Kind.OBJECT_TYPE_EXTENSION) {
                         context.stateBuilder.objectType.field.setScopes(typeDef.name.value, parent.name.value, scopes);
@@ -63,12 +72,24 @@ function RequiresScopesRule(context) {
                 }
                 case graphql_1.Kind.OBJECT_TYPE_DEFINITION:
                 case graphql_1.Kind.OBJECT_TYPE_EXTENSION:
+                    if (context.stateBuilder.isInterfaceObject(parent.name.value)) {
+                        context.reportError(new graphql_1.GraphQLError(`Invalid use of @requiresScopes on interface object "${parent.name.value}": @requiresScopes cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
                     context.stateBuilder.objectType.setScopes(parent.name.value, scopes);
                     break;
                 case graphql_1.Kind.INTERFACE_TYPE_DEFINITION:
                 case graphql_1.Kind.INTERFACE_TYPE_DEFINITION:
-                    context.stateBuilder.interfaceType.setScopes(parent.name.value, scopes);
-                    break;
+                    context.reportError(new graphql_1.GraphQLError(`Invalid use of @requiresScopes on interface "${parent.name.value}": @requiresScopes cannot be applied on interfaces, interface fields and interface objects`, {
+                        extensions: {
+                            code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                        },
+                    }));
+                    return;
                 case graphql_1.Kind.SCALAR_TYPE_DEFINITION:
                 case graphql_1.Kind.SCALAR_TYPE_EXTENSION:
                     context.stateBuilder.scalarType.setScopes(parent.name.value, scopes);

package/cjs/supergraph/composition/ast.js

@@ -528,16 +528,6 @@ function createAuthenticatedDirectiveNode() {
         arguments: [],
     };
 }
-function deduplicatePoliciesOrScopes(items) {
-    const stringified = items.map((group) => group.sort().join("ɵ"));
-    const indexesToRemove = [];
-    for (let index = 0; index < stringified.length; index++) {
-        if (stringified.indexOf(stringified[index]) !== index) {
-            indexesToRemove.push(index);
-        }
-    }
-    return items.filter((_, index) => !indexesToRemove.includes(index));
-}
 function createPolicyDirectiveNode(policies) {
     return {
         kind: graphql_1.Kind.DIRECTIVE,
@@ -554,7 +544,7 @@ function createPolicyDirectiveNode(policies) {
                 },
                 value: {
                     kind: graphql_1.Kind.LIST,
-                    values: deduplicatePoliciesOrScopes(policies).map((group) => ({
+                    values: policies.map((group) => ({
                         kind: graphql_1.Kind.LIST,
                         values: group.map((policy) => ({
                             kind: graphql_1.Kind.STRING,
@@ -582,7 +572,7 @@ function createRequiresScopesDirectiveNode(scopes) {
                 },
                 value: {
                     kind: graphql_1.Kind.LIST,
-                    values: deduplicatePoliciesOrScopes(scopes).map((group) => ({
+                    values: scopes.map((group) => ({
                         kind: graphql_1.Kind.LIST,
                         values: group.map((scope) => ({
                             kind: graphql_1.Kind.STRING,
@@ -726,7 +716,8 @@ function createCostDirectiveNode(input) {
 }
 function createListSizeDirectiveNode(input) {
     const args = [];
-    if (input.requireOneSlicingArgument === false) {
+    if (input.requireOneSlicingArgument === false ||
+        input.printRequireOneSlicingArgument === true) {
         args.push({
             kind: graphql_1.Kind.ARGUMENT,
             name: {
@@ -735,7 +726,7 @@ function createListSizeDirectiveNode(input) {
             },
             value: {
                 kind: graphql_1.Kind.BOOLEAN,
-                value: false,
+                value: input.requireOneSlicingArgument === true,
             },
         });
     }

package/cjs/supergraph/composition/enum-type.js

@@ -4,6 +4,7 @@ exports.enumTypeBuilder = enumTypeBuilder;
 const helpers_js_1 = require("../../utils/helpers.js");
 const ast_js_1 = require("./ast.js");
 const common_js_1 = require("./common.js");
+const auth_js_1 = require("../../utils/auth.js");
 function enumTypeBuilder() {
     return {
         visitSubgraphState(graph, state, typeName, type) {
@@ -16,10 +17,10 @@ function enumTypeBuilder() {
                 enumTypeState.authenticated = true;
             }
             if (type.policies) {
-                enumTypeState.policies.push(...type.policies);
+                enumTypeState.policies = (0, auth_js_1.mergeScopePolicies)(enumTypeState.policies, type.policies);
             }
             if (type.scopes) {
-                enumTypeState.scopes.push(...type.scopes);
+                enumTypeState.scopes = (0, auth_js_1.mergeScopePolicies)(enumTypeState.scopes, type.scopes);
             }
             if (type.cost !== null) {
                 enumTypeState.cost = (0, helpers_js_1.mathMax)(type.cost, enumTypeState.cost);

package/cjs/supergraph/composition/interface-type.js

@@ -4,6 +4,7 @@ exports.interfaceTypeBuilder = interfaceTypeBuilder;
 const helpers_js_1 = require("../../utils/helpers.js");
 const ast_js_1 = require("./ast.js");
 const common_js_1 = require("./common.js");
+const auth_js_1 = require("../../utils/auth.js");
 function interfaceTypeBuilder() {
     return {
         visitSubgraphState(graph, state, typeName, type) {
@@ -12,15 +13,6 @@ function interfaceTypeBuilder() {
             if (type.inaccessible) {
                 interfaceTypeState.inaccessible = true;
             }
-            if (type.authenticated) {
-                interfaceTypeState.authenticated = true;
-            }
-            if (type.policies) {
-                interfaceTypeState.policies.push(...type.policies);
-            }
-            if (type.scopes) {
-                interfaceTypeState.scopes.push(...type.scopes);
-            }
             if (type.isDefinition) {
                 interfaceTypeState.hasDefinition = true;
             }
@@ -62,16 +54,17 @@ function interfaceTypeBuilder() {
                     fieldState.authenticated = true;
                 }
                 if (field.policies) {
-                    fieldState.policies.push(...field.policies);
+                    fieldState.policies = (0, auth_js_1.mergeScopePolicies)(fieldState.policies, field.policies);
                 }
                 if (field.scopes) {
-                    fieldState.scopes.push(...field.scopes);
+                    fieldState.scopes = (0, auth_js_1.mergeScopePolicies)(fieldState.scopes, field.scopes);
                 }
                 if (field.cost !== null) {
                     fieldState.cost = (0, helpers_js_1.mathMax)(field.cost, fieldState.cost);
                 }
                 if (field.listSize !== null) {
                     fieldState.listSize = {
+                        printRequireOneSlicingArgument: false,
                         assumedSize: (0, helpers_js_1.mathMaxNullable)(fieldState.listSize?.assumedSize, field.listSize.assumedSize),
                         requireOneSlicingArgument: (fieldState.listSize?.requireOneSlicingArgument ?? true) &&
                             field.listSize.requireOneSlicingArgument,
@@ -101,6 +94,9 @@ function interfaceTypeBuilder() {
                     version: graph.version,
                     external: field.external,
                     shareable: field.shareable,
+                    authenticated: field.authenticated,
+                    policies: field.policies,
+                    scopes: field.scopes,
                     usedAsKey,
                 });
                 for (const arg of field.args.values()) {
@@ -134,6 +130,31 @@ function interfaceTypeBuilder() {
                 }
             }
         },
+        composeSupergraphState(interfaceType, graphs, { supergraphState }) {
+            const implementors = Array.from(interfaceType.implementedBy)
+                .map((typeName) => supergraphState.objectTypes.get(typeName))
+                .filter(helpers_js_1.isDefined);
+            for (const implementor of implementors) {
+                interfaceType.scopes = (0, auth_js_1.mergeScopePolicies)(interfaceType.scopes, implementor.scopes);
+                interfaceType.policies = (0, auth_js_1.mergeScopePolicies)(interfaceType.policies, implementor.policies);
+                if (implementor.authenticated) {
+                    interfaceType.authenticated = true;
+                }
+            }
+            for (const field of interfaceType.fields.values()) {
+                for (const implementor of implementors) {
+                    let implementorField = implementor.fields.get(field.name);
+                    if (!implementorField) {
+                        continue;
+                    }
+                    field.scopes = (0, auth_js_1.mergeScopePolicies)(field.scopes, implementorField.scopes);
+                    field.policies = (0, auth_js_1.mergeScopePolicies)(field.policies, implementorField.policies);
+                    if (implementorField.authenticated) {
+                        field.authenticated = true;
+                    }
+                }
+            }
+        },
         composeSupergraphNode(interfaceType, graphs, { supergraphState }) {
             return (0, ast_js_1.createInterfaceTypeNode)({
                 name: interfaceType.name,

package/cjs/supergraph/composition/object-type.js

@@ -5,6 +5,7 @@ exports.objectTypeBuilder = objectTypeBuilder;
 const helpers_js_1 = require("../../utils/helpers.js");
 const ast_js_1 = require("./ast.js");
 const common_js_1 = require("./common.js");
+const auth_js_1 = require("../../utils/auth.js");
 function isRealExtension(meta, version) {
     const hasExtendsDirective = meta.extensionType === "@extends";
     if (meta.extension) {
@@ -33,10 +34,10 @@ function objectTypeBuilder() {
                 objectTypeState.authenticated = true;
             }
             if (type.policies) {
-                objectTypeState.policies.push(...type.policies);
+                objectTypeState.policies = (0, auth_js_1.mergeScopePolicies)(objectTypeState.policies, type.policies);
             }
             if (type.scopes) {
-                objectTypeState.scopes.push(...type.scopes);
+                objectTypeState.scopes = (0, auth_js_1.mergeScopePolicies)(objectTypeState.scopes, type.scopes);
             }
             if (type.cost !== null) {
                 objectTypeState.cost = (0, helpers_js_1.mathMax)(type.cost, objectTypeState.cost);
@@ -68,6 +69,9 @@ function objectTypeBuilder() {
                 shareable: type.shareable,
                 interfaces: type.interfaces,
                 version: graph.version,
+                authenticated: type.authenticated,
+                policies: type.policies.slice(),
+                scopes: type.scopes.slice(),
             });
             const typeInGraph = objectTypeState.byGraph.get(graph.id);
             for (const field of type.fields.values()) {
@@ -100,16 +104,17 @@ function objectTypeBuilder() {
                     fieldState.authenticated = true;
                 }
                 if (field.policies) {
-                    fieldState.policies.push(...field.policies);
+                    fieldState.policies = (0, auth_js_1.mergeScopePolicies)(fieldState.policies, field.policies);
                 }
                 if (field.scopes) {
-                    fieldState.scopes.push(...field.scopes);
+                    fieldState.scopes = (0, auth_js_1.mergeScopePolicies)(fieldState.scopes, field.scopes);
                 }
                 if (field.cost !== null) {
                     fieldState.cost = (0, helpers_js_1.mathMax)(field.cost, fieldState.cost);
                 }
                 if (field.listSize !== null) {
                     fieldState.listSize = {
+                        printRequireOneSlicingArgument: false,
                         assumedSize: (0, helpers_js_1.mathMaxNullable)(fieldState.listSize?.assumedSize, field.listSize.assumedSize),
                         requireOneSlicingArgument: (fieldState.listSize?.requireOneSlicingArgument ?? true) &&
                             field.listSize.requireOneSlicingArgument,
@@ -145,6 +150,9 @@ function objectTypeBuilder() {
                     required: field.required,
                     shareable: field.shareable,
                     extension: field.extension,
+                    authenticated: field.authenticated,
+                    policies: field.policies,
+                    scopes: field.scopes,
                     used: field.used,
                     usedAsKey,
                     version: graph.version,
@@ -184,6 +192,27 @@ function objectTypeBuilder() {
                 }
             }
         },
+        composeSupergraphState(objectType, _graphs, { supergraphState }) {
+            for (const interfaceName of objectType.interfaces) {
+                const interfaceState = supergraphState.interfaceTypes.get(interfaceName);
+                if (!interfaceState) {
+                    throw new Error(`Interface "${interfaceName}" not found in Supergraph state`);
+                }
+                for (const [interfaceFieldName, interfaceField,] of interfaceState.fields) {
+                    if (!interfaceState.hasInterfaceObject) {
+                        continue;
+                    }
+                    const fieldState = objectType.fields.get(interfaceFieldName);
+                    if (fieldState) {
+                        fieldState.scopes = (0, auth_js_1.mergeScopePolicies)(fieldState.scopes, interfaceField.scopes);
+                        fieldState.policies = (0, auth_js_1.mergeScopePolicies)(fieldState.policies, interfaceField.policies);
+                        if (interfaceField.authenticated) {
+                            fieldState.authenticated = true;
+                        }
+                    }
+                }
+            }
+        },
         composeSupergraphNode(objectType, graphs, { graphNameToId, supergraphState }) {
             const isQuery = objectType.name === "Query";
             const joinTypes = isQuery
@@ -573,13 +602,23 @@ function objectTypeBuilder() {
                     .concat(resolvableFieldsFromInterfaceObjects
                     .filter((f) => !objectType.fields.has(f.name))
                     .map((field) => {
+                    let scopes = [];
+                    let policies = [];
+                    let authenticated = false;
+                    for (const fieldInGraph of field.byGraph.values()) {
+                        scopes = (0, auth_js_1.mergeScopePolicies)(scopes, fieldInGraph.scopes);
+                        policies = (0, auth_js_1.mergeScopePolicies)(policies, fieldInGraph.policies);
+                        if (fieldInGraph.authenticated) {
+                            authenticated = true;
+                        }
+                    }
                     return {
                         name: field.name,
                         type: field.type,
                         inaccessible: field.inaccessible,
-                        authenticated: field.authenticated,
-                        policies: field.policies,
-                        scopes: field.scopes,
+                        authenticated,
+                        policies,
+                        scopes,
                         cost: field.cost !== null
                             ? {
                                 cost: field.cost,

package/cjs/supergraph/composition/scalar-type.js

@@ -4,6 +4,7 @@ exports.scalarTypeBuilder = scalarTypeBuilder;
 const helpers_js_1 = require("../../utils/helpers.js");
 const ast_js_1 = require("./ast.js");
 const common_js_1 = require("./common.js");
+const auth_js_1 = require("../../utils/auth.js");
 function scalarTypeBuilder() {
     return {
         visitSubgraphState(graph, state, typeName, type) {
@@ -16,10 +17,10 @@ function scalarTypeBuilder() {
                 scalarTypeState.authenticated = true;
             }
             if (type.policies) {
-                scalarTypeState.policies.push(...type.policies);
+                scalarTypeState.policies = (0, auth_js_1.mergeScopePolicies)(scalarTypeState.policies, type.policies);
             }
             if (type.scopes) {
-                scalarTypeState.scopes.push(...type.scopes);
+                scalarTypeState.scopes = (0, auth_js_1.mergeScopePolicies)(scalarTypeState.scopes, type.scopes);
             }
             if (type.cost !== null) {
                 scalarTypeState.cost = (0, helpers_js_1.mathMax)(type.cost, scalarTypeState.cost);