add more tests.

Author: gmac

lib/graphql/stitching/executor.rb

@@ -45,14 +45,8 @@ def perform(raw: false)
           result["data"] = raw ? @data : Shaper.new(@request).perform!(@data)
         end
 
-        @request.plan.errors.each do |error|
-          case error.code
-          when "unauthorized"
-            @errors << {
-              "message" => "Unauthorized access",
-              "path" => error.path,
-            }
-          end
+        @request.plan.errors.each do |err|
+          @errors << err.to_h
         end
 
         if @errors.length > 0

lib/graphql/stitching/plan.rb

@@ -66,6 +66,10 @@ def ==(other)
       end
 
       class Error
+        MESSAGE_BY_CODE = {
+          "unauthorized" => "Unauthorized access",
+        }.freeze
+
         attr_reader :code, :path
 
         def initialize(code:, path:)
@@ -79,6 +83,14 @@ def as_json
             path: path,
           }
         end
+
+        def to_h
+          {
+            "message" => MESSAGE_BY_CODE[@code],
+            "path" => @path,
+            "extensions" => { "code" => @code },
+          }
+        end
       end
 
       class << self

test/graphql/stitching/integration/authorizations_test.rb

@@ -11,20 +11,85 @@ def setup
     })
   end
 
-  def test_responds_with_error
+  def test_responds_with_errors_for_each_unauthorized_child_field
     query = %|{
       orderA(id: "1") {
         customer1 {
           phone
+          slack
         }
       }
     }|
 
-    result = plan_and_execute(@supergraph, query, claims: ["orders"]) do |plan|
-      pp plan.as_json
-    end
+    result = plan_and_execute(@supergraph, query, claims: ["orders"])
+    expected = {
+      "data" => { 
+        "orderA" => { 
+          "customer1" => {
+            "phone" => nil,
+            "slack" => nil,
+          },
+        },
+      },
+      "errors" => [{
+        "message" => "Unauthorized access",
+        "path" => ["orderA", "customer1", "phone"],
+        "extensions" => { "code" => "unauthorized" },
+      }, {
+        "message" => "Unauthorized access",
+        "path" => ["orderA", "customer1", "slack"],
+        "extensions" => { "code" => "unauthorized" },
+      }],
+    }
 
-    pp result.to_h
-    assert true
+    assert_equal expected, result.to_h
+  end
+
+  def test_errors_of_non_null_child_fields_bubble
+    query = %|{
+      orderA(id: "1") {
+        customer1 {
+          email
+        }
+      }
+    }|
+
+    result = plan_and_execute(@supergraph, query, claims: ["orders"])
+    expected = {
+      "data" => { 
+        "orderA" => { "customer1" => nil },
+      },
+      "errors" => [{
+        "message" => "Unauthorized access",
+        "path" => ["orderA", "customer1", "email"],
+        "extensions" => { "code" => "unauthorized" },
+      }],
+    }
+
+    assert_equal expected, result.to_h
+  end
+  
+  def test_responds_with_error_for_unauthorized_parent_field
+    query = %|{
+      orderA(id: "1") {
+        customer2 {
+          phone
+        }
+      }
+    }|
+
+    result = plan_and_execute(@supergraph, query, claims: ["orders"])
+    expected = {
+      "data" => { 
+        "orderA" => { "customer2" => nil },
+      },
+      "errors" => [{
+        "message" => "Unauthorized access",
+        "path" => ["orderA", "customer2"],
+        "extensions" => { "code" => "unauthorized" },
+      }],
+    }
+
+    assert_equal expected, result.to_h
   end
 end

test/schemas/authorizations.rb

@@ -18,6 +18,7 @@ class Customer < GraphQL::Schema::Object
         directive GraphQL::Stitching::Directives::Authorization, scopes: [["customers"]]
         field :email, String, null: false
         field :phone, String, null: true
+        field :slack, String, null: true
       end
 
       class Product < GraphQL::Schema::Object