detect lists properly in error paths for authorization

[Geal]

The lists were not correctly recognized when building the error path in the authorization plugin. This has no impact on actual authorization, types that require authorization are still properly recognized even in a list or non null

---

Checklist

Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.

• [ ] Changes are compatible[^1]
• [ ] Documentation[^2] completed
• [ ] Performance impact assessed and acceptable
• Tests added and passing[^3]
  • [ ] Unit Tests
  • [ ] Integration Tests
  • [ ] Manual Tests

Exceptions

Note any exceptions here

Notes

[^1]: It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. [^2]: Configuration is an important part of many changes. Where applicable please try to document configuration examples. [^3]: Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions.

[github-actions[bot]]

@Geal, please consider creating a changeset entry in /.changesets/. These instructions describe the process and tooling.

[router-perf[bot]]

CI performance tests

• [ ] events_big_cap_high_rate - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity
• [ ] events_without_dedup - Stress test for events with a lot of users and deduplication DISABLED
• [ ] events - Stress test for events with a lot of users and deduplication ENABLED
• [ ] large-request - Stress test with a 1 MB request payload
• [x] step - Basic stress test that steps up the number of users over time
• [ ] xlarge-request - Stress test with 10 MB request payload
• [ ] reload - Reload test over a long period of time at a constant rate of users
• [ ] no-graphos - Basic stress test, no GraphOS.
• [ ] xxlarge-request - Stress test with 100 MB request payload
• [ ] step-jemalloc-tuning - Clone of the basic stress test for jemalloc tuning
• [x] const - Basic stress test that runs with a constant number of users

[Geal]

putting this one back in draft, because there's an issue I had not predicted: when we remove fields from types inside a list, we don't know how many elements will be in that list. IF we have the following schema:

type Query {
  organizations: [Organization]
}

type Organization {
  name: String
  members: [User]
}

type User @authenticated {
  name: String
}

For the query query { organizations { name members { name } } }, if we are not authenticated, we will get the filtered query query organizations { name } and the error path /organizations/@/members/@, with @ the "flatten" path element we use in query planning, that indicates it applies to all elements of the array. So if we had the following data:

{
  "organizations": [{
    "name": "first",
    "members": [{
        "name": "A"
      },
      {
        "name": "B"
      }]
    },
    {
      "name": "second",
      "members": [{
        "name": "C"
      }]
    }]
}

We need to generate the following paths:

• /organizations/0/members/0
• /organizations/0/members/1
• /organizations/1/members/0

That error dispatching should happen in the execution service, after response formatting

[garypen]

I approved this, because the code changes looked good, and then changed my mind after I read your comment . Is it something we still need?