Fix mutation access control

README.md

@@ -761,7 +761,7 @@ Expression | Description | Scope
 **request** | Refers to the current request. | Request
 **token** | Refers to the token which is currently in the security token storage. | Token 
 **user** | Refers to the user which is currently in the security token storage. | Valid Token
-**object** | Refers to the value of the field for which access is being requested. For array `object` will be each item of the array. For Relay connection `object` will be the node of each connection edges. | only available for `config.fields.*.access`
+**object** | Refers to the value of the field for which access is being requested. For array `object` will be each item of the array. For Relay connection `object` will be the node of each connection edges. | only available for `config.fields.*.access` with query operation type.
 **value** | Resolver value | only available in resolve context 
 **args** | Resolver args array | only available in resolve context 
 **info** | Resolver GraphQL\Type\Definition\ResolveInfo Object | only available in resolve context

Resolver/Config/AbstractConfigSolution.php

@@ -108,13 +108,18 @@ public function setConfigResolver($configResolver)
 
     protected function solveUsingExpressionLanguageIfNeeded($expression, array $values = [])
     {
-        if (is_string($expression) &&  0 === strpos($expression, '@=')) {
+        if ($this->isExpression($expression)) {
             return $this->expressionLanguage->evaluate(substr($expression, 2), $values);
         }
 
         return $expression;
     }
 
+    protected function isExpression($expression)
+    {
+        return is_string($expression) &&  0 === strpos($expression, '@=');
+    }
+
     protected function solveResolveCallbackArgs()
     {
         $args = func_get_args();

Resolver/Config/FieldsConfigSolution.php

@@ -11,6 +11,7 @@
 
 namespace Overblog\GraphQLBundle\Resolver\Config;
 
+use GraphQL\Type\Definition\ResolveInfo;
 use Overblog\GraphQLBundle\Definition\Argument;
 use Overblog\GraphQLBundle\Definition\Builder\MappingInterface;
 use Overblog\GraphQLBundle\Error\UserError;
@@ -177,16 +178,23 @@ private function resolveResolveAndAccessIfNeeded(array $options)
         return $treatedOptions;
     }
 
-    private function resolveAccessAndWrapResolveCallback($expression, callable $resolveCallback = null)
+    private function resolveAccessAndWrapResolveCallback($expression, callable $resolveCallback)
     {
         return function () use ($expression, $resolveCallback) {
             $args = func_get_args();
 
-            $result = null !== $resolveCallback  ? call_user_func_array($resolveCallback, $args) : null;
-
             $values = call_user_func_array([$this, 'solveResolveCallbackArgs'], $args);
 
-            return $this->filterResultUsingAccess($result, $expression, $values);
+            $info = $values['info'];
+
+            if ($info instanceof ResolveInfo && $info->operation->operation === 'mutation') {
+                $checkAccess = $this->checkAccessCallback($expression, $values);
+                $result = $checkAccess(null, $values) ? call_user_func_array($resolveCallback, $args) : null;
+            } else {
+                $result = $this->filterResultUsingAccess(call_user_func_array($resolveCallback, $args), $expression, $values);
+            }
+
+            return $result;
         };
     }