@theguild/federation-composition 0.20.2 → 0.21.0

package/cjs/supergraph/state.js

@@ -49,6 +49,12 @@ function createSupergraphStateBuilder() {
     const unionType = (0, union_type_js_1.unionTypeBuilder)();
     const subgraphStates = new Map();
     const graphNameToIdMap = {};
+    const helpers = {
+        graphNameToId(graphName) {
+            return graphNameToIdMap[graphName] ?? null;
+        },
+        supergraphState: state,
+    };
     return {
         addSubgraph(subgraph) {
             if (state.subgraphs.has(subgraph.graph.id)) {
@@ -60,6 +66,43 @@ function createSupergraphStateBuilder() {
         getGraph(id) {
             return state.subgraphs.get(id);
         },
+        composeSupergraphState() {
+            if (directive.composeSupergraphState) {
+                state.directives.forEach((s) => {
+                    directive.composeSupergraphState(s, state.subgraphs, helpers);
+                });
+            }
+            if (scalarType.composeSupergraphState) {
+                state.scalarTypes.forEach((s) => {
+                    scalarType.composeSupergraphState(s, state.subgraphs, helpers);
+                });
+            }
+            if (enumType.composeSupergraphState) {
+                state.enumTypes.forEach((s) => {
+                    enumType.composeSupergraphState(s, state.subgraphs, helpers);
+                });
+            }
+            if (inputObjectType.composeSupergraphState) {
+                state.inputObjectTypes.forEach((s) => {
+                    inputObjectType.composeSupergraphState(s, state.subgraphs, helpers);
+                });
+            }
+            if (objectType.composeSupergraphState) {
+                state.objectTypes.forEach((s) => {
+                    objectType.composeSupergraphState(s, state.subgraphs, helpers);
+                });
+            }
+            if (interfaceType.composeSupergraphState) {
+                state.interfaceTypes.forEach((s) => {
+                    interfaceType.composeSupergraphState(s, state.subgraphs, helpers);
+                });
+            }
+            if (unionType.composeSupergraphState) {
+                state.unionTypes.forEach((s) => {
+                    unionType.composeSupergraphState(s, state.subgraphs, helpers);
+                });
+            }
+        },
         visitSubgraphState(subgraphState) {
             subgraphStates.set(subgraphState.graph.id, subgraphState);
             for (const link of subgraphState.links) {
@@ -134,12 +177,6 @@ function createSupergraphStateBuilder() {
         },
         build() {
             const transformFields = createFieldsTransformer(state);
-            const helpers = {
-                graphNameToId(graphName) {
-                    return graphNameToIdMap[graphName] ?? null;
-                },
-                supergraphState: state,
-            };
             for (const directiveState of state.directives.values()) {
                 if (!directiveState.isExecutable || !directiveState.byGraph.size) {
                     continue;

package/cjs/supergraph/validation/rules/auth-on-requires-rule.js

@@ -0,0 +1,211 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthOnRequiresRule = AuthOnRequiresRule;
+const graphql_1 = require("graphql");
+const helpers_js_1 = require("../../../subgraph/helpers.js");
+const auth_js_1 = require("../../../utils/auth.js");
+function AuthOnRequiresRule(context, supergraph) {
+    return {
+        ObjectTypeField(objectTypeState, fieldState) {
+            for (const [graphId, fieldInGraph] of fieldState.byGraph) {
+                if (!fieldInGraph.requires) {
+                    continue;
+                }
+                const selectionSet = (0, helpers_js_1.parseFields)(fieldInGraph.requires);
+                if (!selectionSet) {
+                    continue;
+                }
+                const provisionedAccess = new ProvisionedAccess(objectTypeState, fieldState);
+                let fieldLackingAccess = ensureAccessToSelectionSet(supergraph, objectTypeState, selectionSet, provisionedAccess);
+                if (fieldLackingAccess) {
+                    context.reportError(createAccessRequirementError(context.graphIdToName(graphId), `${objectTypeState.name}.${fieldState.name}`, fieldLackingAccess));
+                    return;
+                }
+            }
+        },
+    };
+}
+function ensureAccessToSelectionSet(supergraph, currentType, selectionSet, provisionedAccess) {
+    for (const selection of selectionSet.selections) {
+        switch (selection.kind) {
+            case graphql_1.Kind.FIELD: {
+                if (currentType.kind === "union") {
+                    throw new Error("Cannot select fields directly on union types.");
+                }
+                const fieldLackingAccess = ensureAccessToField(supergraph, currentType, selection, provisionedAccess);
+                if (fieldLackingAccess) {
+                    return fieldLackingAccess;
+                }
+                break;
+            }
+            case graphql_1.Kind.INLINE_FRAGMENT: {
+                const fieldLackingAccess = ensureAccessToInlineFragment(supergraph, currentType, selection, provisionedAccess);
+                if (fieldLackingAccess) {
+                    return fieldLackingAccess;
+                }
+                break;
+            }
+            case graphql_1.Kind.FRAGMENT_SPREAD: {
+                throw new Error("Fragment spreads are not supported in @requires.");
+            }
+        }
+    }
+}
+function ensureAccessToField(supergraph, currentType, fieldNode, provisionedAccess) {
+    if (fieldNode.name.value === "__typename") {
+        return;
+    }
+    let fieldName = fieldNode.name.value;
+    let fieldState = currentType.fields.get(fieldNode.name.value);
+    let fieldDetails = null;
+    if (fieldState) {
+        fieldDetails = {
+            type: fieldState.type,
+            scopes: fieldState.scopes,
+            policies: fieldState.policies,
+            authenticated: fieldState.authenticated,
+        };
+    }
+    else {
+        if (currentType.kind === "interface") {
+            throw new Error(`Field "${fieldNode.name.value}" not found on interface type "${currentType.name}".`);
+        }
+        for (const interfaceName of currentType.interfaces) {
+            const interfaceType = supergraph.interfaceTypes.get(interfaceName);
+            if (!interfaceType) {
+                throw new Error(`Interface "${interfaceName}" implemented by "${currentType.name}" not found in supergraph.`);
+            }
+            const interfaceFieldState = interfaceType.fields.get(fieldNode.name.value);
+            if (interfaceFieldState) {
+                if (!fieldDetails) {
+                    fieldDetails = {
+                        type: interfaceFieldState.type,
+                        scopes: (0, auth_js_1.mergeScopePolicies)([], interfaceFieldState.scopes),
+                        policies: (0, auth_js_1.mergeScopePolicies)([], interfaceFieldState.policies),
+                        authenticated: interfaceFieldState.authenticated,
+                    };
+                }
+                else {
+                    fieldDetails = {
+                        type: interfaceFieldState.type,
+                        scopes: (0, auth_js_1.mergeScopePolicies)(fieldDetails.scopes, interfaceFieldState.scopes),
+                        policies: (0, auth_js_1.mergeScopePolicies)(fieldDetails.policies, interfaceFieldState.policies),
+                        authenticated: interfaceFieldState.authenticated
+                            ? true
+                            : fieldDetails.authenticated,
+                    };
+                }
+            }
+        }
+    }
+    if (fieldDetails === null) {
+        throw new Error(`Field "${fieldName}" not found on type "${currentType.name}".`);
+    }
+    if (!provisionedAccess.canAccess(fieldDetails)) {
+        return `${currentType.name}.${fieldName}`;
+    }
+    const outputTypeName = extractNamedTypeName(fieldDetails.type);
+    if (!outputTypeName) {
+        throw new Error(`Unable to extract output type name from field "${currentType.name}.${fieldName}" type "${fieldDetails.type}".`);
+    }
+    if (graphql_1.specifiedScalarTypes.some((s) => s.name === outputTypeName)) {
+        return;
+    }
+    const outputType = supergraph.objectTypes.get(outputTypeName) ??
+        supergraph.interfaceTypes.get(outputTypeName) ??
+        supergraph.enumTypes.get(outputTypeName) ??
+        supergraph.scalarTypes.get(outputTypeName) ??
+        supergraph.unionTypes.get(outputTypeName);
+    if (!outputType) {
+        throw new Error(`Output type "${outputTypeName}" of field "${currentType.name}.${fieldName}" not found in supergraph.`);
+    }
+    if (outputType.kind !== "union" && !provisionedAccess.canAccess(outputType)) {
+        return `${currentType.name}.${fieldName}`;
+    }
+    if (!fieldNode.selectionSet) {
+        return;
+    }
+    if (outputType.kind === "enum" || outputType.kind === "scalar") {
+        throw new Error(`Field "${currentType.name}.${fieldName}" of type "${outputType.name}" cannot have a selection set.`);
+    }
+    return ensureAccessToSelectionSet(supergraph, outputType, fieldNode.selectionSet, provisionedAccess);
+}
+function ensureAccessToInlineFragment(supergraph, currentType, inlineFragment, provisionedAccess) {
+    const concreteType = inlineFragment.typeCondition
+        ? (supergraph.objectTypes.get(inlineFragment.typeCondition.name.value) ??
+            supergraph.interfaceTypes.get(inlineFragment.typeCondition.name.value))
+        : currentType;
+    if (!concreteType) {
+        throw new Error(`Type "${currentType.name}" not found in supergraph for inline fragment.`);
+    }
+    if (concreteType.kind == "union") {
+        throw new Error("Cannot have inline fragments on union types without type conditions.");
+    }
+    if (!provisionedAccess.canAccess(concreteType)) {
+        return concreteType.name;
+    }
+    return ensureAccessToSelectionSet(supergraph, concreteType, inlineFragment.selectionSet, provisionedAccess);
+}
+function createAccessRequirementError(graphName, fieldWithRequiresCoordinate, authCoordinate) {
+    const strDataRef = authCoordinate.includes(".")
+        ? `field "${authCoordinate}"`
+        : `type "${authCoordinate}"`;
+    return new graphql_1.GraphQLError(`[${graphName}] Field "${fieldWithRequiresCoordinate}" does not specify necessary @authenticated, @requiresScopes and/or @policy auth requirements to access the transitive ${strDataRef} data from @requires selection set.`, {
+        extensions: {
+            code: "MISSING_TRANSITIVE_AUTH_REQUIREMENTS",
+        },
+    });
+}
+function extractNamedTypeName(typeStr) {
+    let typeName = typeStr;
+    if (!typeName)
+        return null;
+    typeName = typeName.replace(/[![\]]/g, "");
+    return typeName || null;
+}
+class ProvisionedAccess {
+    scopes;
+    policies;
+    authenticated;
+    constructor(objectTypeState, fieldState) {
+        this.scopes = [];
+        this.policies = [];
+        this.authenticated = false;
+        if (objectTypeState.authenticated) {
+            this.authenticated = true;
+        }
+        if (objectTypeState.scopes.length > 0) {
+            this.scopes = objectTypeState.scopes.slice();
+        }
+        if (objectTypeState.policies.length > 0) {
+            this.policies = objectTypeState.policies.slice();
+        }
+        if (fieldState.authenticated) {
+            this.authenticated = true;
+        }
+        if (fieldState.scopes.length > 0) {
+            this.scopes = (0, auth_js_1.mergeScopePolicies)(this.scopes, fieldState.scopes);
+        }
+        if (fieldState.policies.length > 0) {
+            this.policies = (0, auth_js_1.mergeScopePolicies)(this.policies, fieldState.policies);
+        }
+    }
+    canAccess(required) {
+        if (required.authenticated && !this.authenticated) {
+            return false;
+        }
+        for (const requiredScopeGroup of required.scopes) {
+            const satisfiedByAny = this.scopes.some((providedGroup) => requiredScopeGroup.every((scope) => providedGroup.includes(scope)));
+            if (!satisfiedByAny) {
+                return false;
+            }
+        }
+        for (const requiredPolicyGroup of required.policies) {
+            const satisfiedByAny = this.policies.some((providedGroup) => requiredPolicyGroup.every((policy) => providedGroup.includes(policy)));
+            if (!satisfiedByAny) {
+                return false;
+            }
+        }
+        return true;
+    }
+}

package/cjs/supergraph/validation/rules/external-missing-on-base-rule.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExternalMissingOnBaseRule = ExternalMissingOnBaseRule;
 const graphql_1 = require("graphql");
 const format_js_1 = require("../../../utils/format.js");
-function ExternalMissingOnBaseRule(context) {
+function ExternalMissingOnBaseRule(context, supergraph) {
     return {
         ObjectType(objectTypeState) {
             if (Array.from(objectTypeState.byGraph).every(([_, stateInGraph]) => stateInGraph.external === true)) {
@@ -32,6 +32,31 @@ function ExternalMissingOnBaseRule(context) {
                 }
                 return fieldStateInGraph.external === true;
             })) {
+                for (let interfaceName of objectState.interfaces) {
+                    let interfaceState = supergraph.interfaceTypes.get(interfaceName);
+                    if (!interfaceState) {
+                        continue;
+                    }
+                    if (!interfaceState.hasInterfaceObject) {
+                        continue;
+                    }
+                    for (let [graphId, interfaceStateInGraph] of interfaceState.byGraph) {
+                        if (!interfaceStateInGraph.isInterfaceObject) {
+                            continue;
+                        }
+                        let interfaceFieldState = interfaceState.fields.get(fieldState.name);
+                        if (!interfaceFieldState) {
+                            continue;
+                        }
+                        let interfaceFieldInGraph = interfaceFieldState.byGraph.get(graphId);
+                        if (!interfaceFieldInGraph) {
+                            continue;
+                        }
+                        if (interfaceFieldInGraph.external !== true) {
+                            return;
+                        }
+                    }
+                }
                 const subgraphs = fieldState.byGraph.size > 1 ? "subgraphs" : "subgraph";
                 context.reportError(new graphql_1.GraphQLError(`Field "${objectState.name}.${fieldState.name}" is marked @external on all the subgraphs in which it is listed (${subgraphs} ${(0, format_js_1.andList)(Array.from(fieldState.byGraph.keys()).map(context.graphIdToName), true, '"')}).`, {
                     extensions: {

package/cjs/supergraph/validation/rules/list-size-slicing-arguments-rule.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ListSizeSlicingArgumentsRule = ListSizeSlicingArgumentsRule;
+const graphql_1 = require("graphql");
+function ListSizeSlicingArgumentsRule(context, supergraph) {
+    return {
+        ObjectTypeField(objectState, fieldState) {
+            let error = ensureSlicingArgumentsExist(objectState.name, fieldState);
+            if (error) {
+                context.reportError(error);
+            }
+        },
+        InterfaceTypeField(interfaceState, fieldState) {
+            let error = ensureSlicingArgumentsExist(interfaceState.name, fieldState);
+            if (error) {
+                context.reportError(error);
+                return;
+            }
+            if (!fieldState?.listSize ||
+                !fieldState?.listSize.slicingArguments?.length) {
+                return;
+            }
+            for (const implementorName of interfaceState.implementedBy) {
+                const implementorType = supergraph.objectTypes.get(implementorName);
+                if (!implementorType) {
+                    continue;
+                }
+                let implementorField = implementorType.fields.get(fieldState.name);
+                if (!implementorField) {
+                    continue;
+                }
+                if (!implementorField.listSize) {
+                    continue;
+                }
+                if (!implementorField.listSize.slicingArguments?.length) {
+                    continue;
+                }
+                fieldState.listSize.printRequireOneSlicingArgument = true;
+            }
+        },
+    };
+}
+function ensureSlicingArgumentsExist(typeName, fieldState) {
+    if (!fieldState.listSize?.slicingArguments?.length) {
+        return;
+    }
+    const newslicingArguments = [];
+    for (const argName of fieldState.listSize.slicingArguments) {
+        const argState = fieldState.args.get(argName);
+        if (!argState) {
+            throw new Error("Could not find the argument in the field annotated with @listSize");
+        }
+        if (argState.byGraph.size !== fieldState.byGraph.size) {
+            continue;
+        }
+        newslicingArguments.push(argName);
+    }
+    if (!newslicingArguments.length) {
+        return new graphql_1.GraphQLError([
+            `All arguments for @listSize(slicingArguments:) on field "${typeName}.${fieldState.name}" were disregarded.`,
+            `For an argument to be valid, it must be defined in every subgraph where the field exists.`,
+        ].join(" "), {
+            extensions: {
+                code: "LIST_SIZE_INVALID_SLICING_ARGUMENT",
+            },
+        });
+    }
+    fieldState.listSize.slicingArguments = newslicingArguments;
+}

package/cjs/supergraph/validation/validate-supergraph.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateSupergraph = validateSupergraph;
 const visitor_js_1 = require("../composition/visitor.js");
+const auth_on_requires_rule_js_1 = require("./rules/auth-on-requires-rule.js");
 const default_value_uses_inaccessible_rule_js_1 = require("./rules/default-value-uses-inaccessible-rule.js");
 const directive_composition_rule_js_1 = require("./rules/directive-composition-rule.js");
 const enum_values_rule_js_1 = require("./rules/enum-values-rule.js");
@@ -20,6 +21,7 @@ const interface_object_usage_error_js_1 = require("./rules/interface-object-usag
 const interface_subtype_rule_js_1 = require("./rules/interface-subtype-rule.js");
 const invalid_field_sharing_rule_js_1 = require("./rules/invalid-field-sharing-rule.js");
 const link_import_name_mismatch_rule_js_1 = require("./rules/link-import-name-mismatch-rule.js");
+const list_size_slicing_arguments_rule_js_1 = require("./rules/list-size-slicing-arguments-rule.js");
 const no_inaccessible_on_implemented_interface_fields_rule_js_1 = require("./rules/no-inaccessible-on-implemented-interface-fields-rule.js");
 const only_inaccessible_children_rule_js_1 = require("./rules/only-inaccessible-children-rule.js");
 const override_source_has_override_js_1 = require("./rules/override-source-has-override.js");
@@ -52,6 +54,7 @@ function validateSupergraph(subgraphStates, state, __internal) {
     for (const subgraphState of subgraphStates.values()) {
         state.visitSubgraphState(subgraphState);
     }
+    state.composeSupergraphState();
     const postSupergraphRules = [
         interface_field_no_implementation_rule_js_1.InterfaceFieldNoImplementationRule,
         extension_with_base_js_1.ExtensionWithBaseRule,
@@ -79,6 +82,8 @@ function validateSupergraph(subgraphStates, state, __internal) {
         required_argument_or_field_is_not_inaccessible_rule_js_1.RequiredArgumentOrFieldIsNotInaccessibleRule,
         interface_subtype_rule_js_1.InterfaceSubtypeRule,
         no_inaccessible_on_implemented_interface_fields_rule_js_1.NoInaccessibleOnImplementedInterfaceFieldsRule,
+        list_size_slicing_arguments_rule_js_1.ListSizeSlicingArgumentsRule,
+        auth_on_requires_rule_js_1.AuthOnRequiresRule,
     ];
     const supergraph = state.getSupergraphState();
     (0, visitor_js_1.visitSupergraphState)(supergraph, postSupergraphRules.map((rule) => {

package/cjs/utils/auth.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeScopePolicies = mergeScopePolicies;
+function mergeScopePolicies(policyA, policyB) {
+    if (policyA.length === 0 || policyB.length === 0) {
+        return policyA.length
+            ? policyA.map((group) => [...group])
+            : policyB.map((group) => [...group]);
+    }
+    const groupMap = new Map();
+    for (const groupA of policyA) {
+        for (const groupB of policyB) {
+            const merged = Array.from(new Set([...groupA, ...groupB])).sort();
+            const key = merged.join(",");
+            groupMap.set(key, merged);
+        }
+    }
+    const candidates = Array.from(groupMap.values()).sort((a, b) => a.length - b.length);
+    const finalGroups = [];
+    for (const candidate of candidates) {
+        if (!finalGroups.some((existing) => isSubset(existing, candidate))) {
+            finalGroups.push(candidate);
+        }
+    }
+    finalGroups.sort((a, b) => a.length - b.length || a.join(",").localeCompare(b.join(",")));
+    return finalGroups;
+}
+function isSubset(subset, superset) {
+    if (subset.length > superset.length) {
+        return false;
+    }
+    const supersetSet = new Set(superset);
+    return subset.every((item) => supersetSet.has(item));
+}

package/esm/subgraph/state.js

@@ -2,6 +2,7 @@ import { Kind, OperationTypeNode, specifiedScalarTypes, DirectiveLocation, } fro
 import { print } from "../graphql/printer.js";
 import { isFederationLink, } from "../specifications/federation.js";
 import { printOutputType } from "./helpers.js";
+import { mergeScopePolicies } from "../utils/auth.js";
 export var TypeKind;
 (function (TypeKind) {
     TypeKind["OBJECT"] = "OBJECT";
@@ -630,10 +631,12 @@ function scalarTypeFactory(state) {
             getOrCreateScalarType(state, typeName).authenticated = true;
         },
         setPolicies(typeName, policies) {
-            getOrCreateScalarType(state, typeName).policies.push(...policies);
+            const existing = getOrCreateScalarType(state, typeName);
+            existing.policies = mergeScopePolicies(existing.policies, policies);
         },
         setScopes(typeName, scopes) {
-            getOrCreateScalarType(state, typeName).scopes.push(...scopes);
+            const existing = getOrCreateScalarType(state, typeName);
+            existing.scopes = mergeScopePolicies(existing.scopes, scopes);
         },
         setCost(typeName, cost) {
             getOrCreateScalarType(state, typeName).cost = cost;
@@ -712,23 +715,16 @@ function objectTypeFactory(state, renameObject, interfaceTypeBuilder, isInterfac
             objectType.inaccessible = true;
         },
         setAuthenticated(typeName) {
-            if (isInterfaceObject(typeName)) {
-                return interfaceTypeBuilder.setAuthenticated(typeName);
-            }
             const objectType = getOrCreateObjectType(state, renameObject, typeName);
             objectType.authenticated = true;
         },
         setPolicies(typeName, policies) {
-            if (isInterfaceObject(typeName)) {
-                return interfaceTypeBuilder.setPolicies(typeName, policies);
-            }
-            getOrCreateObjectType(state, renameObject, typeName).policies.push(...policies);
+            const existing = getOrCreateObjectType(state, renameObject, typeName);
+            existing.policies = mergeScopePolicies(existing.policies, policies);
         },
         setScopes(typeName, scopes) {
-            if (isInterfaceObject(typeName)) {
-                return interfaceTypeBuilder.setScopes(typeName, scopes);
-            }
-            getOrCreateObjectType(state, renameObject, typeName).scopes.push(...scopes);
+            const existing = getOrCreateObjectType(state, renameObject, typeName);
+            existing.scopes = mergeScopePolicies(existing.scopes, scopes);
         },
         setCost(typeName, cost) {
             if (isInterfaceObject(typeName)) {
@@ -805,13 +801,15 @@ function objectTypeFactory(state, renameObject, interfaceTypeBuilder, isInterfac
                 if (isInterfaceObject(typeName)) {
                     return interfaceTypeBuilder.field.setPolicies(typeName, fieldName, policies);
                 }
-                getOrCreateObjectField(state, renameObject, typeName, fieldName).policies.push(...policies);
+                let existing = getOrCreateObjectField(state, renameObject, typeName, fieldName);
+                existing.policies = mergeScopePolicies(existing.policies, policies);
             },
             setScopes(typeName, fieldName, scopes) {
                 if (isInterfaceObject(typeName)) {
                     return interfaceTypeBuilder.field.setScopes(typeName, fieldName, scopes);
                 }
-                getOrCreateObjectField(state, renameObject, typeName, fieldName).scopes.push(...scopes);
+                let existing = getOrCreateObjectField(state, renameObject, typeName, fieldName);
+                existing.scopes = mergeScopePolicies(existing.scopes, scopes);
             },
             setCost(typeName, fieldName, cost) {
                 if (isInterfaceObject(typeName)) {
@@ -976,16 +974,6 @@ function interfaceTypeFactory(state) {
             const objectType = getOrCreateInterfaceType(state, typeName);
             objectType.inaccessible = true;
         },
-        setAuthenticated(typeName) {
-            const t = getOrCreateInterfaceType(state, typeName);
-            t.authenticated = true;
-        },
-        setPolicies(typeName, policies) {
-            getOrCreateInterfaceType(state, typeName).policies.push(...policies);
-        },
-        setScopes(typeName, scopes) {
-            getOrCreateInterfaceType(state, typeName).scopes.push(...scopes);
-        },
         setTag(typeName, tag) {
             getOrCreateInterfaceType(state, typeName).tags.add(tag);
         },
@@ -1014,10 +1002,12 @@ function interfaceTypeFactory(state) {
                     true;
             },
             setPolicies(typeName, fieldName, policies) {
-                getOrCreateInterfaceField(state, typeName, fieldName).policies.push(...policies);
+                const existing = getOrCreateInterfaceField(state, typeName, fieldName);
+                existing.policies = mergeScopePolicies(existing.policies, policies);
             },
             setScopes(typeName, fieldName, scopes) {
-                getOrCreateInterfaceField(state, typeName, fieldName).scopes.push(...scopes);
+                const existing = getOrCreateInterfaceField(state, typeName, fieldName);
+                existing.scopes = mergeScopePolicies(existing.scopes, scopes);
             },
             setCost(typeName, fieldName, cost) {
                 getOrCreateInterfaceField(state, typeName, fieldName).cost = cost;
@@ -1189,10 +1179,12 @@ function enumTypeFactory(state) {
             getOrCreateEnumType(state, typeName).authenticated = true;
         },
         setPolicies(typeName, policies) {
-            getOrCreateEnumType(state, typeName).policies.push(...policies);
+            const existing = getOrCreateEnumType(state, typeName);
+            existing.policies = mergeScopePolicies(existing.policies, policies);
         },
         setScopes(typeName, scopes) {
-            getOrCreateEnumType(state, typeName).scopes.push(...scopes);
+            const existing = getOrCreateEnumType(state, typeName);
+            existing.scopes = mergeScopePolicies(existing.scopes, scopes);
         },
         setCost(typeName, cost) {
             getOrCreateEnumType(state, typeName).cost = cost;
@@ -1368,9 +1360,6 @@ function getOrCreateInterfaceType(state, typeName) {
         extension: false,
         keys: [],
         inaccessible: false,
-        authenticated: false,
-        policies: [],
-        scopes: [],
         tags: new Set(),
         interfaces: new Set(),
         implementedBy: new Set(),

package/esm/subgraph/validation/rules/elements/authenticated.js

@@ -1,4 +1,4 @@
-import { Kind } from "graphql";
+import { GraphQLError, Kind } from "graphql";
 import { validateDirectiveAgainstOriginal } from "../../../helpers.js";
 export function AuthenticatedRule(context) {
     return {
@@ -30,6 +30,15 @@ export function AuthenticatedRule(context) {
                     if (!typeDef) {
                         throw new Error("Could not find the parent type of the field annotated with @authenticated");
                     }
+                    if (typeDef.kind === Kind.INTERFACE_TYPE_DEFINITION ||
+                        typeDef.kind === Kind.INTERFACE_TYPE_EXTENSION) {
+                        context.reportError(new GraphQLError(`Invalid use of @authenticated on field "${typeDef.name.value}.${parent.name.value}": @authenticated cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
                     if (typeDef.kind === Kind.OBJECT_TYPE_DEFINITION ||
                         typeDef.kind === Kind.OBJECT_TYPE_EXTENSION) {
                         context.stateBuilder.objectType.field.setAuthenticated(typeDef.name.value, parent.name.value);
@@ -38,12 +47,24 @@ export function AuthenticatedRule(context) {
                 }
                 case Kind.OBJECT_TYPE_DEFINITION:
                 case Kind.OBJECT_TYPE_EXTENSION:
+                    if (context.stateBuilder.isInterfaceObject(parent.name.value)) {
+                        context.reportError(new GraphQLError(`Invalid use of @authenticated on interface object "${parent.name.value}": @authenticated cannot be applied on interfaces, interface fields and interface objects`, {
+                            extensions: {
+                                code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                            },
+                        }));
+                        return;
+                    }
                     context.stateBuilder.objectType.setAuthenticated(parent.name.value);
                     break;
                 case Kind.INTERFACE_TYPE_DEFINITION:
                 case Kind.INTERFACE_TYPE_DEFINITION:
-                    context.stateBuilder.interfaceType.setAuthenticated(parent.name.value);
-                    break;
+                    context.reportError(new GraphQLError(`Invalid use of @authenticated on interface "${parent.name.value}": @authenticated cannot be applied on interfaces, interface fields and interface objects`, {
+                        extensions: {
+                            code: "AUTH_REQUIREMENTS_APPLIED_ON_INTERFACE",
+                        },
+                    }));
+                    return;
                 case Kind.SCALAR_TYPE_DEFINITION:
                 case Kind.SCALAR_TYPE_EXTENSION:
                     context.stateBuilder.scalarType.setAuthenticated(parent.name.value);

package/esm/subgraph/validation/rules/elements/cost.js

@@ -55,7 +55,12 @@ export function CostRule(context) {
                     }
                     if (typeDef.kind === Kind.INTERFACE_TYPE_DEFINITION ||
                         typeDef.kind === Kind.INTERFACE_TYPE_EXTENSION) {
-                        context.stateBuilder.interfaceType.field.setCost(typeDef.name.value, parent.name.value, weight);
+                        context.reportError(new GraphQLError(`@cost cannot be applied to interface "${typeDef.name.value}.${parent.name.value}"`, {
+                            extensions: {
+                                code: "COST_APPLIED_TO_INTERFACE_FIELD",
+                            },
+                        }));
+                        return;
                     }
                     break;
                 }
@@ -86,7 +91,12 @@ export function CostRule(context) {
                         if (!argDef) {
                             throw new Error("Could not find the argument annotated with @cost");
                         }
-                        context.stateBuilder.interfaceType.field.arg.setCost(typeDef.name.value, fieldDef.name.value, argDef.name.value, weight);
+                        context.reportError(new GraphQLError(`@cost cannot be applied to interface "${typeDef.name.value}.${fieldDef.name.value}" argument "${argDef.name.value}"`, {
+                            extensions: {
+                                code: "COST_APPLIED_TO_INTERFACE_FIELD",
+                            },
+                        }));
+                        return;
                     }
                     break;
                 case Kind.OBJECT_TYPE_DEFINITION: