DisableIntrospection.ts

import { PostGraphilePlugin } from "postgraphile";
import * as graphql from "graphql";

const DisableIntrospection: PostGraphilePlugin = {
  ["postgraphile:validationRules:static"](args, _context) {
    if (process.env.ALLOW_INTROSPECTION) {
      return [args];
    }

    return [
      ...args,
      (context: graphql.ValidationContext) => {
        return {
          Field(node) {
            if (
              node.name.value === "__schema" ||
              node.name.value === "__type"
            ) {
              context.reportError(
                new graphql.GraphQLError(
                  "GraphQL introspection is not allowed, but the query contained __schema or __type",
                  [node]
                )
              );
            }
          },
        };
      },
    ];
  },
};

export default DisableIntrospection;

This snippet is dangerous; you disabled all the built in GraphQL validations and only enabled your one, that's a major security issue.

The _args you're ignoring is the other validation rules, you must include those as part of the result; so you should return [..._args, /* your new validation rule here */].

Thanks Benjie!

Gist updated.

On line 7 you need to return the args too