Confirm authorization on GraphQL resolvers per field

A single endpoint serves all GraphQL, so middleware that guards REST routes does nothing here. Review each resolver for an authorization check.

grep -rEn "Resolver|@Query|@Mutation|resolve_|def resolve" --include=*.{js,ts,py,java} .

The bug returns data with no per-resolver check.

user: (_, {id}) => db.users.findById(id)   // no ctx.user ownership/role check

Pro note: nested resolvers are the sneaky part; a guarded top-level query can expose sensitive fields through an unguarded child resolver. Also review batching and aliasing exposure, and confirm depth and complexity limits exist to prevent resource abuse.