title: GraphQL: How to restrict fields server-side across queries?
body: <p>Let's say I have a User type that contains the following fields:</p>
  
  <pre><code>type User {
    name: String
    username: String
    someOtherField1: String
    someOtherField2: String
    someOtherField3: String
    someOtherField4: String
    creditCardNumber: String
  }
  </code></pre>
  
  <p>If I am querying for myself, it's okay to return all fields, because the information is mine. So returning <code>creditCardNumber</code> to the client is no biggie. But if I am querying for someone else, I should only be able to access the public info on the returned user. Returning <code>creditCardNumber</code> would be terrible. And even if I don't code the query on the client to do so, what would prevent a malicious user from digging into the code, updating the client-side query to include <code>creditCardNumber</code>, and executing it?</p>
  
  <p>What is the best way to achieve this level of field restriction across queries in GraphQL? My only thought on this so far is to create a separate <code>UserSearch</code> type, i.e.</p>
  
  <pre><code>type UserSearch {
    name: String
    username: String
    someOtherField1: String
    someOtherField2: String
    someOtherField3: String
    someOtherField4: String
  }
  </code></pre>
  
  <p>which excludes the private fields, however this does not feel DRY as you'd be creating many types that are 90% similar in structure form each other.</p>
  
  <p>Is there a cleaner way to implement this, that doesn't create unnecessary types or duplicate fields?</p>