CVE-2026-107728: Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

PermissionExtension.resolve() evaluates the return value of has_permission() for truthiness on the synchronous path. supports_sync only classifies a permission as asynchronous when has_permission is declared with async def (via inspect.iscoroutinefunction), so a plain def that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves to False and the protected resolver runs.

The resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both execute_sync() and execute(). Permissions declared with async def has_permission(), or a plain def returning a boolean, are not affected.