So, I edited my permissions for User.* and required authorisation for all CRUD ops. If I use the basic mutation

createUser

without authorisation, I get stopped with an error for insufficient permissions, which is what I expect. However, when using the authorisation template providing the basic email/passwd auth, invoking the mutation

signupUser

doesn’t yield any error, but actually creates the user, even though I can see the source code is (obviously) using the basic

createUser

mutation. Thoughts?