fixed permission bug

graph/resolvers/root_query.js

@@ -91,6 +91,9 @@ decorateWithPermissionCheck(
     if (user && user.id === id) {
       return true;
     }
+
+    // We don't return false because we want to fallthrough to the permission
+    // check if the custom check fails.
   }
 );
 

graph/resolvers/util.js

@@ -88,11 +88,7 @@ const wrapCheckPermissions = (
   wrapCheck(
     typeResolver,
     field,
-    (obj, args, ctx) => {
-      if (checkPermissions(ctx, permissions)) {
-        return false;
-      }
-    },
+    (obj, args, ctx) => !checkPermissions(ctx, permissions),
     skipFieldResolver
   );