support repeatable directive

[Eomm]

At the moment a repeatable directive is executed once: the first directive only.

The 2nd one instead is not executed or processed.

const Fastify = require('fastify')
const mercurius = require('mercurius')
const mercuriusAuth = require('mercurius-auth')

const schema = `
  directive @hasPermission (grant: String!) repeatable on OBJECT | FIELD_DEFINITION

  type Message {
    title: String!
    notes: String @hasPermission(grant: "lv1") @hasPermission(grant: "lv2")
  }

  type Query {
    publicMessages(org: String): [Message!]
  }
`

const resolvers = {
  Query: {
    publicMessages: async () => {
      return [
        { title: 'one', message: 'acme one', notes: 'acme-one' },
        { title: 'two', message: 'acme two', notes: 'acme-two' }
      ]
    }
  }
}

const app = Fastify()
app.register(mercurius, {
  graphiql: true,
  schema,
  resolvers
})

app.register(mercuriusAuth, {
  authContext: hasPermissionContext,
  applyPolicy: hasPermissionPolicy,
  namespace: 'authorization-filtering',
  authDirective: 'hasPermission'
})

app.listen(3000)

function hasPermissionContext (context) {
  return { permission: context.reply.request.headers['x-permission'].split(',') }
}
async function hasPermissionPolicy (authDirectiveAST, parent, args, context, info) {
  const needed = authDirectiveAST.arguments.find(arg => arg.name.value === 'grant').value.value
  const hasGrant = context.auth.permission.includes(needed)
  if (!hasGrant) {
    throw new Error(`Needed ${needed} grant`)
  }
  return true
}

I think the issue is on this line:

auth/lib/auth.js

Line 29 in 16db4b5

const authDirective = astNode.directives.find(directive => directive.name.value === this[kAuthDirective])

find should be filter instead.
Changing the output to an array impacts to the getPolicy() public API. I'm not sure about the impacts

[jonnydgreen]

Good find and nice explanation - we should definitely support this (as you mentioned, I think we may need to add this support to the external policy API - so we'll need to be careful to avoid breaking existing functionality) - would you like to work on a draft PR so we can discuss the approach there?