Strawberry GraphQL 0.337

Apply the Python 3 prompt first. These rules cover Strawberry schemas, HTTP integrations, permissions, Pydantic models, Relay and federation entry points, uploads, batching, and streaming transports on this line.

Identity and field access

• Authenticate in the host framework and pass the verified principal and tenant through get_context or FastAPI's context_getter. Check each HTTP operation, upload, WebSocket connection, and SSE request; neither info.context nor BasePermission verifies a credential by itself.
• Attach PermissionExtension(permissions=[...]) to protected fields, including nested fields and mutations; audit existing permission_classes declarations, which still install that extension implicitly. Recheck tenant and object access in the data loader or repository before returning or changing a record; a parent-field check does not cover an alternate relay.node, _entities, or mutation route.
• Define asynchronous BasePermission.has_permission checks with async def; synchronous checks must return a plain boolean. Treat an unexpected awaitable as an authorization failure, and do not catch its error to continue a resolver.
• Keep permission and extension objects free of mutable per-user decisions. Read identity from info.context, and scope any shared result cache to the verified principal, tenant, policy, operation, and variables so a cache hit cannot bypass field permissions.
• Use fail_silently=True only where denial intentionally becomes None or an empty list on a compatible field. Audit the denial without putting secrets or internal