Commit 3e1a0fd

`schema.ToGraphQLSchemaString()` always outputs the full schema — use it to generate SDL files for tooling and type generation.

To get SDL filtered for a user, use `ToGraphQLSchemaStringAsync(user)`. It uses the schema's `AuthorizationService` exactly as query execution does, and applies the same rules as introspection.

var sdl = await schema.ToGraphQLSchemaStringAsync(user);

The result is self-consistent SDL: nothing in it refers to a type it does not define. Protected types are left out, as are fields that are protected, return a hidden type or take an argument of a hidden type. A type whose fields are all hidden is itself hidden, which can in turn hide the fields returning it. Protected interfaces are dropped from `implements` lists, and protected types from union member lists. A directive with an argument of a hidden type is hidden. The query root always stays: for a user who can see no query fields it is output as a bare `type Query`, which parses but fails schema validation, as there is no valid SDL for a schema with nothing in it. Introspection hides exactly the same types and fields, so `__schema`, `__type` and the SDL agree.

This is useful when handing a schema to a person or an AI agent (e.g. an MCP server tool), where fields they cannot query are noise or information they should not have. SDL is far more compact than an introspection result for the same information.

using System.Security.Claims;

using System.Threading;

using System.Threading.Tasks;

/// <summary>SDL with only what the user in <paramref name="requestContext"/> may see. See SchemaProvider for details.</summary>

// default implementations so adding these does not break anyone implementing ISchemaProvider themselves

string ToGraphQLSchemaString(QueryRequestContext? requestContext, bool includeDescriptions = true) => SchemaGenerator.Make(this, includeDescriptions, requestContext);

/// <summary>SDL with only what <paramref name="user"/> may see, filtered by this schema's AuthorizationService. See SchemaProvider for details.</summary>

async Task<string> ToGraphQLSchemaStringAsync(ClaimsPrincipal? user, bool includeDescriptions = true, CancellationToken cancellationToken = default)

{

var authorizationService = await AuthorizationService.PrepareForRequestAsync(this, user, cancellationToken);

return SchemaGenerator.Make(this, includeDescriptions, new QueryRequestContext(authorizationService, user));

}

/// <param name="requestContext">When supplied only the types and fields this user may access are output, using the same

/// rules as introspection (see <see cref="SchemaVisibility"/>). Null outputs everything</param>

internal static string Make(ISchemaProvider schema, bool includeDescriptions = true, QueryRequestContext? requestContext = null)

var visibility = SchemaVisibility.For(schema, requestContext);

var types = BuildSchemaTypes(schema, includeDescriptions, visibility);

bool outputMutation = VisibleFields(mutationType, visibility).Any();

bool outputSubscription = VisibleFields(subscriptionType, visibility).Any();

foreach (var item in schema.GetScalarTypes().Distinct().Where(visibility.IsTypeVisible).OrderBy(t => t.Name))

foreach (var directive in schema.GetDirectives().Where(visibility.IsDirectiveVisible).OrderBy(t => t.Name))

schemaBuilder.Append(BuildEnumTypes(schema, includeDescriptions, visibility));

schemaBuilder.AppendLine(OutputSchemaType(schema, schema.GetSchemaType(schema.QueryContextName, null), includeDescriptions, visibility));

schemaBuilder.AppendLine(OutputSchemaType(schema, schema.Mutation().SchemaType, includeDescriptions, visibility));

schemaBuilder.AppendLine(OutputSchemaType(schema, schema.Subscription().SchemaType, includeDescriptions, visibility));

/// <summary>Fields of a type that are output: not internal (__) and visible to the user, if filtering</summary>

private static IEnumerable<IField> VisibleFields(ISchemaType schemaType, SchemaVisibility visibility) =>

schemaType.GetFields().Where(f => !f.Name.StartsWith("__", StringComparison.InvariantCulture) && visibility.IsFieldVisible(f));

private static string BuildEnumTypes(ISchemaProvider schema, bool includeDescriptions, SchemaVisibility visibility)

if (!visibility.IsTypeVisible(typeItem))

continue;

private static string BuildSchemaTypes(ISchemaProvider schema, bool includeDescriptions, SchemaVisibility visibility)

if (!visibility.IsTypeVisible(typeItem))

continue;

var output = OutputSchemaType(schema, typeItem, includeDescriptions, visibility);

// without a request context keep the historic output byte-for-byte (it appended even an empty union)

if (output.Length > 0 || !visibility.IsFiltering)

types.AppendLine(output);

private static string OutputSchemaType(ISchemaProvider schema, ISchemaType schemaType, bool includeDescriptions, SchemaVisibility visibility)

var fields = VisibleFields(schemaType, visibility).OrderBy(s => s.Name).ToList();

var possibleTypes = schemaType.PossibleTypesReadOnly.Where(visibility.IsTypeVisible).ToList();

if (possibleTypes.Count == 0)

sb.AppendLine($"union {schemaType.Name} = {string.Join(" | ", possibleTypes.Select(i => i.Name))}");

var baseTypes = schemaType.BaseTypesReadOnly?.Where(visibility.IsTypeVisible).ToList();

if (baseTypes != null && baseTypes.Count > 0)

implements += $" implements {string.Join(" & ", baseTypes.Select(i => i.Name))}";

}

// the query root can be left with no fields (SchemaVisibility hides any other type it empties). The SDL grammar

// allows a type with no field block, so it stays a parseable root rather than disappearing from under `schema`

if (visibility.IsFiltering && fields.Count == 0 && schemaType.Name == schema.QueryContextName)

{

sb.AppendLine($"{type} {schemaType.Name}{implements}{GetDirectives(schemaType.Directives)}");

return sb.ToString();

foreach (var field in fields)