Check authorization of returned type

[joemcbride]

At present the validation rule doesn’t check the returned GraphType of the Field that is being request, only that the current Field itself is allowed. The returned GraphType may have different authorization policies applied to it.

authorization/src/GraphQL.Authorization/AuthorizationValidationRule.cs

Line 40 in b9f3edf

CheckAuth(fieldAst, fieldDef, userContext, context, operationType);

I believe the fix is to add this additional line:

CheckAuth(fieldAst, fieldDef.ResolvedType, userContext, context, operationType); 

See graphql-dotnet/graphql-dotnet#502 (comment)