The RootQueryToContentNode connection is returning posts of post_types that are not public.

For example, with the WPGatsby plugin active, the following query from a public user:

{
  contentNodes {
    nodes {
      __typename
    }
  }
}

Is returning nodes of the ActionMonitor Type, a non-public post_type.

The Model Layer for SURE needs to be fixed to ensure non-public posts are not being returned, even if an underlying query asks for them.

We should also optimize the connection queries to only ask for things we know the user can ask for.

Some context that might be helpful to resolving this:

• The post types that are queried for are centrally checked in the Connection Resolver here: https://github.com/wp-graphql/wp-graphql/blob/develop/src/Data/Connection/PostObjectConnectionResolver.php#L56-L57. Limiting this centrally to public post types could help.

• Here (https://github.com/wp-graphql/wp-graphql/blob/develop/src/Model/Post.php#L329-L331) the Post model is allowing posts of any post type to be public, as long as they're published