Add security filters and assertions to queries and fields

[rspeele]

For GraphQL to be realistically useful it needs to be possible to integrate security restrictions into the schema.

These commonly take 2.5 forms:

1. Filters that silently hide data from view - these should usually be able to happen at the IQueryable level. Maybe they have to also work in memory afterwards?
2. Assertions that throw exceptions if a user tries to see something they shouldn't - for maximum flexibility these should happen in memory after the query runs.

This is a big issue that requires a lot of thought, and it depends on #17 . Consider this a long term. It may be best to implement #16 first so we understand how to implement the security requirements around mutations first.

[kierenj]

It looks like #16 and #17 are closed off. I'm evaluating GraphQL (via GraphQL.Net) as a potential technology choice, and am keen to know if there is anything currently planned around this issue?

I'm happy to share some thoughts around how this might be implemented, or the kinds of requirements that I'd see as important, if that is of any use?

(I kind of feel like this is a case of supporting some kind of "middleware" approach: intercepting queries and having a chance to chain an extra Where(), for instance.)