Added ability to control field visibility on schema definition

src/Executor/ReferenceExecutor.php

@@ -601,6 +601,10 @@ protected function resolveField(ObjectType $parentType, $rootValue, \ArrayObject
             return static::$UNDEFINED;
         }
 
+        if (! $fieldDef->isVisible($contextValue)) {
+            return static::$UNDEFINED;
+        }
+
         $returnType = $fieldDef->getType();
         // The resolve function's optional 3rd argument is a context value that
         // is provided to every resolve function within an execution. It is commonly

src/Type/Definition/FieldDefinition.php

@@ -16,12 +16,14 @@
  *
  * @phpstan-type FieldType (Type&OutputType)|callable(): (Type&OutputType)
  * @phpstan-type ComplexityFn callable(int, array<string, mixed>): int
+ * @phpstan-type VisibilityFn callable(mixed): bool
  * @phpstan-type FieldDefinitionConfig array{
  *     name: string,
  *     type: FieldType,
  *     resolve?: FieldResolver|null,
  *     args?: ArgumentListConfig|null,
  *     description?: string|null,
+ *     visible?: VisibilityFn|bool,
  *     deprecationReason?: string|null,
  *     astNode?: FieldDefinitionNode|null,
  *     complexity?: ComplexityFn|null
@@ -31,6 +33,7 @@
  *     resolve?: FieldResolver|null,
  *     args?: ArgumentListConfig|null,
  *     description?: string|null,
+ *     visible?: VisibilityFn|bool,
  *     deprecationReason?: string|null,
  *     astNode?: FieldDefinitionNode|null,
  *     complexity?: ComplexityFn|null
@@ -64,6 +67,13 @@ class FieldDefinition
 
     public ?string $description;
 
+    /**
+     * @var callable|bool
+     *
+     * @phpstan-var VisibilityFn|bool
+     */
+    public $visible;
+
     public ?string $deprecationReason;
 
     public ?FieldDefinitionNode $astNode;
@@ -94,6 +104,7 @@ public function __construct(array $config)
             ? Argument::listFromConfig($config['args'])
             : [];
         $this->description = $config['description'] ?? null;
+        $this->visible = $config['visible'] ?? true;
         $this->deprecationReason = $config['deprecationReason'] ?? null;
         $this->astNode = $config['astNode'] ?? null;
         $this->complexityFn = $config['complexity'] ?? null;
@@ -181,6 +192,15 @@ public function getType(): Type
         return $this->type ??= Schema::resolveType($this->config['type']);
     }
 
+    public function isVisible(mixed $context): bool
+    {
+        if (is_callable($this->visible)) {
+            return call_user_func($this->visible, $context);
+        }
+
+        return true;
+    }
+
     public function isDeprecated(): bool
     {
         return (bool) $this->deprecationReason;

src/Type/Introspection.php

@@ -352,17 +352,24 @@ public static function _type(): ObjectType
                             'defaultValue' => false,
                         ],
                     ],
-                    'resolve' => static function (Type $type, $args): ?array {
+                    'resolve' => static function (Type $type, $args, $context): ?array {
                         if ($type instanceof ObjectType || $type instanceof InterfaceType) {
                             $fields = $type->getFields();
 
-                            if (! ($args['includeDeprecated'] ?? false)) {
-                                $fields = \array_filter(
-                                    $fields,
-                                    static fn (FieldDefinition $field): bool => $field->deprecationReason === null
-                                        || $field->deprecationReason === ''
-                                );
-                            }
+                            $fields = \array_filter(
+                                $fields,
+                                static function (FieldDefinition $field) use ($args, $context): bool {
+                                    if (! $field->isVisible($context)) {
+                                        return false;
+                                    }
+
+                                    if ($field->isDeprecated() && ! ($args['includeDeprecated'] ?? false)) {
+                                        return false;
+                                    }
+
+                                    return true;
+                                }
+                            );
 
                             return $fields;
                         }

tests/Executor/ExecutorSchemaTest.php

@@ -30,6 +30,12 @@ public function testExecutesUsingASchema(): void
                 'url' => ['type' => Type::string()],
                 'width' => ['type' => Type::int()],
                 'height' => ['type' => Type::int()],
+                'mimetype' => [
+                    'type' => Type::string(),
+                    'visible' => function ($context): bool {
+                        return false;
+                    },
+                ],
             ],
         ]);
 
@@ -107,7 +113,8 @@ public function testExecutesUsingASchema(): void
             pic(width: 640, height: 480) {
               url,
               width,
-              height
+              height,
+              mimetype
             },
             recentArticle {
               ...articleFields,
@@ -222,6 +229,7 @@ private function article(string $id): array
             'url' => "cdn://{$uid}",
             'width' => $width,
             'height' => $height,
+            'mimetype' => 'image/gif',
         ];
 
         $johnSmith = [

tests/Type/IntrospectionTest.php

@@ -1725,4 +1725,50 @@ public function testExecutesAnIntrospectionQueryWithoutCallingGlobalFieldResolve
         GraphQL::executeQuery($schema, $source, null, null, null, null, $fieldResolver);
         self::assertEmpty($calledForFields);
     }
+
+    /** @see it('does not expose invisible fields') */
+    public function testDoesNotExposeInvisibleFields(): void
+    {
+        $TestType = new ObjectType([
+            'name' => 'TestType',
+            'fields' => [
+                'nonVisible' => [
+                    'type' => Type::string(),
+                    'visible' => function ($context): bool {
+                        return false;
+                    },
+                ],
+                'visible' => [
+                    'type' => Type::string(),
+                ],
+            ],
+        ]);
+
+        $schema = new Schema(['query' => $TestType]);
+        $request = '
+          {
+            __type(name: "TestType") {
+              name
+              fields {
+                name
+              }
+            }
+          }
+        ';
+
+        $expected = [
+            'data' => [
+                '__type' => [
+                    'name' => 'TestType',
+                    'fields' => [
+                        [
+                            'name' => 'visible',
+                        ],
+                    ],
+                ],
+            ],
+        ];
+
+        self::assertEquals($expected, GraphQL::executeQuery($schema, $request)->toArray());
+    }
 }