Introspection: require authorization

[Authorization | GraphQL](https://graphql.org/learn/authorization/) talks about delegating authorization logic to the business logic layer. This makes sense to me for most things. One thing I'm not sure on though is how can I lock down introspection if I want to have a tool in production where most people can't use it (for security reasons) but software engineers, product managers, operators, and possibly others who I configure can use introspection so that tools they use (e.g. a hosted GraphiQL or GraphQL Playground app to make queries and even some mutations) will work out of the boxy without needing a schema registry or anything.

Is there a straight forward way to hook into the out-of-the-box introspection tooling in `graphql-js` to run introspection like normal if my user is authorized to do so but return error(s) otherwise?

The issue names no repository files or tests. Start by reading the linked GraphQL authorization guidance and investigating graphql-js introspection behavior; done would be a clear, supported way to allow introspection for authorized users while returning errors for others.

Vom Indexierungsmodell aus dem Issue-Text verfasst.