Fix graphql plugin resolverof

[alexandrebodin]

Description of what you did:

Fix #4035

My PR is a:

• 💥 Breaking change
• 🐛 Bug fix
• 💅 Enhancement
• 🚀 New feature

Main update on the:

• Admin
• Documentation
• Framework
• Plugin

Manual testing done on the following databases:

• Not applicable
• MongoDB
• MySQL
• Postgres
• SQLite

[lauriejim]

LGTM!

[avirankatzsofi]

After updating to beta.16.15, I see that any user can update any other user (given that the updating user is permitted to use updateUser). Is that intended?

[alexandrebodin]

@avirankatzsofi do you mean user or admin ?
if you make the updateUser permission public or authenticated then sadly it will be acessible by the users having the role. There is no notion of context for those routes. if you want a user to be able to update itself you should make a custom mutation for then and those ones are mainly designed to be for administration