[CRITICAL] BUG: Custom field with internal: true, public: false is accessible via Shop API

[Yasser-G]

Describe the bug
Custom field with internal: true, public: false is accessible via Shop API

To Reproduce
Steps to reproduce the behavior:

1. Extend any entity with a new customField named { name: "secretKey", type: "string", defaultValue: "", public: false, internal: true }
2. query the entity via shop api, try to query customFields { secretKey } , you'll get GRAPHQL_VALIDATION_FAILED, with message Field \"customFields\" must not have a selection since type \"JSON\" has no subfields.
3. repeat the query without subfields, just query customFields
4. All internal and private custom fields are now visible

Expected behavior
Internal and private custom fields should not be exposable via Shop API

Environment (please complete the following information):

• @vendure/core version: 3.0.1
• Nodejs version: 18.20.4
• Database (mysql/postgres etc): postgres

[michaelbromley]

Thanks for the report. A patch with the fix will be published this week.

[michaelbromley]

Update: this fix is now available in versions 3.0.2 & 2.3.1