Cannot override or disable certain GraphQL resolvers for plugins (users-permissions & upload)

[abett]

Bug report

Describe the bug

Contrary to expected behavior (described here), setting a $.resolver.Query.xxx or $.resolver.Mutation.xxx to false in a ./extensions/**/config/schema.graphql.js file does not disable the queries in all cases.
Based on observation, if the field has been declared in the $.query or $.mutation key under the node_module/strapi-plugin-**/config/schema.graphql.js previously, it can not be overridden.

Specifically, on the default upload and users-permissions plugins, the query me (users-permissions) and mutations login, register, forgotPassword, resetPassword, emailConfirmation (users-permissions) & upload, multipleUpload, updateFileInfo (upload) can not be disabled.
I also didn't have any luck merely changing a description or adding a deprecation warning.

Steps to reproduce the behavior

1. install strapi-graphql plugin
2. fetch schema of the generated endpoint
   (it should include the autogenerated api for users-permissions & upload)
3. create a file extensions/**/config/schema.graphql.js overriding the defined resolvers of the plugin schema.
   Example contents leading to reproducible behavior below in code-snippet section.
4. restart server

Expected behavior

It is expected that...

• the types set to false should not be queryable
• the queries & mutations set to false should be disabled

Observed behavior

• types are still part of the schema and can be introspected
• some, but not all queries / mutations are disabled

Screenshots

• left: plugin schema definition
• middle: schema override
• right: schema as published to my GraphQL clients

for users-permissions:

for upload:

Code snippets

This can be reproduced by creating a schema config in extensions/upload/config/schema.graphql.js like:

module.exports = {
  type: {
    UploadFile: false
  },
  resolver: {
    Query: {
      files: false,
      filesConnection: false
    },
    Mutation: {
      createFile: false,
      updateFile: false,
      upload: false,
      multipleUpload: false,
      updateFileInfo: false,
      deleteFile: false
    }
  }
};

... similarly for the file extensions/users-permissions/config/schema.graphql.js with:

module.exports = {
  resolver: {
    Query: {
      role: false,
      roles: false,
      rolesConnection: false,
      user: false,
      users: false,
      usersConnection: false,
      me: false
    },
    Mutation: {
      createRole: false,
      updateRole: false,
      deleteRole: false,
      createUser: false,
      updateUser: false,
      deleteUser: false,
      login: false,
      register: false,
      forgotPassword: false,
      resetPassword: false,
      emailConfirmation: false
    }
  }
};

System

• Node.js version: v14.15.0 (as provided in strapi/base Docker image)
• NPM version: 6.14.8 (as provided in strapi/base Docker image)
• Strapi version: 3.3.4
• Database: postgres
• Operating system: strapi/base Docker image, on WSL2 Windows10/Ubuntu20.04

[derrickmehaffy]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/cannot-override-or-deactivate-certain-graphql-resolvers-for-plugins-users-permissions-upload/1580/5

[derrickmehaffy]

closing as PR merged