smallrye
Schema: Integrate with Jakarta Security (`@RolesAllowed`, etc.)
E.g. a @RolesAllowed("admin") can prevent a client from actually using a query, mutation, subscription, or field. Then it shouldn't be in the schema, and trying to use it should create an error response as if it's not there.
This would mean we need "Dynamic" schemas, not just one. So we need to create a schema per role ... something like that. It also means the schema resource needs to become authorized (or at least some of them). We have spoken about this before. I am not sure it's worth the effort. Looking a JAX-RS, you can not do it there...
B.t.w during Runtime, this is supported. Here we only talk about the schema.
Yes, this is only about the schema. Maybe we can filter the schema? My first idea had been to use directives to document the roles required, but filtering is just so much better.
And the fact that MP OpenApi doesn't support it doesn't mean there's no need for it ;-)