Exclude property from GraphQL filters

This allow to completely hide sensitive, both in GraphQL fields by
excluding methods and GraphQL filters by excluding properties.

Author: PowerKiKi

src/Annotation/Exclude.php

@@ -5,12 +5,12 @@
 namespace GraphQL\Doctrine\Annotation;
 
 /**
- * Annotation used to exclude a method from GraphQL fields.
+ * Annotation used to exclude a method from GraphQL fields, or a property from GraphQL filters.
  *
  * This should be used to hide sensitive data such as passwords.
  *
  * @Annotation
- * @Target({"METHOD"})
+ * @Target({"METHOD", "PROPERTY"})
  */
 final class Exclude
 {

src/Factory/Type/FilterGroupConditionTypeFactory.php

@@ -4,6 +4,7 @@
 
 namespace GraphQL\Doctrine\Factory\Type;
 
+use GraphQL\Doctrine\Annotation\Exclude;
 use GraphQL\Doctrine\Annotation\Filter;
 use GraphQL\Doctrine\Annotation\Filters;
 
@@ -25,6 +26,7 @@
 use GraphQL\Type\Definition\LeafType;
 use GraphQL\Type\Definition\Type;
 use ReflectionClass;
+use ReflectionProperty;
 
 /**
  * A factory to create an InputObjectType from a Doctrine entity to
@@ -60,6 +62,13 @@ public function create(string $className, string $typeName): Type
 
                 // Get all scalar fields
                 foreach ($metadata->fieldMappings as $mapping) {
+
+                    // Skip exclusion specified by user
+                    $property = $metadata->getReflectionProperty($mapping['fieldName']);
+                    if ($this->isExcluded($property)) {
+                        continue;
+                    }
+
                     if ($mapping['id'] ?? false) {
                         $leafType = Type::id();
                     } else {
@@ -275,4 +284,18 @@ private function getOperatorFieldName(string $className): string
 
         return lcfirst($name);
     }
+
+    /**
+     * Returns whether the property is excluded
+     *
+     * @param ReflectionProperty $property
+     *
+     * @return bool
+     */
+    private function isExcluded(ReflectionProperty $property): bool
+    {
+        $exclude = $this->getAnnotationReader()->getPropertyAnnotation($property, Exclude::class);
+
+        return $exclude !== null;
+    }
 }

tests/Blog/Model/User.php

@@ -34,6 +34,7 @@ final class User extends AbstractModel
      * @var string
      *
      * @ORM\Column(name="password", type="string", length=255)
+     * @Api\Exclude
      */
     private $password;
 

tests/data/PostFilter.graphqls

@@ -499,7 +499,6 @@ input UserFilterGroupCondition {
   creationDate: UserFilterGroupConditionCreationDate
   name: UserFilterGroupConditionName
   email: UserFilterGroupConditionEmail
-  password: UserFilterGroupConditionPassword
   isAdministrator: UserFilterGroupConditionIsAdministrator
   id: UserFilterGroupConditionId
   posts: UserFilterGroupConditionPosts
@@ -593,20 +592,6 @@ input UserFilterGroupConditionName {
   group: GroupOperatorString
 }
 
-"""Type to specify a condition on a specific field"""
-input UserFilterGroupConditionPassword {
-  between: BetweenOperatorString
-  equal: EqualOperatorString
-  greater: GreaterOperatorString
-  greaterOrEqual: GreaterOrEqualOperatorString
-  in: InOperatorString
-  less: LessOperatorString
-  lessOrEqual: LessOrEqualOperatorString
-  like: LikeOperatorString
-  null: NullOperatorString
-  group: GroupOperatorString
-}
-
 """Type to specify a condition on a specific field"""
 input UserFilterGroupConditionPosts {
   have: HaveOperatorID