Is there a way to prevent enumeration of one of my types, I see a

list

option for the permissions (https://github.com/graphcool/graphcool-json-schema/blob/master/src/schema.json#L105) but when running

graphcool deploy

I have the following error:

Global
    ✖ unhandled error: Wrong operation defined for ModelPermission. You supplied: 'list'

Also, enumeration seems to be enabled for everyone by default

thanks,

list

is not yet implemented: https://github.com/graphcool/graphcool-json-schema/pull/4

I’d like to prevent anyone to get all my Users through a

allUsers

query

remove all permissions for

User.read

Yes, but I still needs that

User.read

permissions for when someone is accessing a user when listing another type, e.g. ‘Comment’ (which have a ‘User’ author)

can you formulate a permission along the lines of this sentence:

Allow any user to read any other user provided it's

id

, prevent 'searching/listing' of all users

ok, I see! how would you obtain the id of a user in the first place?

Through another type, for instance my

Post

or my

Comment

type who both have a relation to

User

and how do they get access to a post or a comment? 🙂

Through

allPosts

for instance,

Comment

is a relation on

Post

ok, so permissions work from the node perspective - so whether or not you can read a node depends on that node and the relationship to the user

I understand, it's not a blocking issue, but It might be a nice thing to have

yep, I totally agree!