Hi, I have the following schema: ``` # Comment # -...
# prisma-whats-new
l
Hi, I have the following schema:
Copy code
# Comment
# - Schema
type Comment @model {
  # Generated by server
  id: ID! @isUnique
  createdAt: DateTime!
  updatedAt: DateTime!

  # Data
  text: String!
  # - Relations
  parent: Comment @relation(name: "CommentOnComment")
  children: [Comment!]! @relation(name: "CommentOnComment")
  author: User! @relation(name: "UserOnComment")
  post: Post! @relation(name: "PostOnComment")
  votes: [CommentVote!]! @relation(name: "CommentOnCommentVote")
}
And the following permission query on
Comment.create
(inspired by https://docs-next.graph.cool/guides/auth/authorization-for-a-cms-miesho4goo#editors-can-only-assign-themselves-as-the-document-owner):
Copy code
query isUser($user_id: ID!, $authorUser_id: ID!) {
  SomeUserExists(filter: {
    AND: [
      { id: $user_id },
      { id: $authorUser_id }
    ]
  })
}
When running the following query (with the right auth token):
Copy code
mutation create {
  createComment(
    text: "Waow, amazing",
    authorId: "cj8tal6jg0pxv0192epmhlaha",
    postId: "cj8vshelb01x601742ff1c0tt",
  ) {
    id
  }
}
I have the following error:
Copy code
Permission Query is invalid. Could not be executed. Error Message: Error during variable coercion. Violations:\n\nVariable '$authorUser_id' expected value of type 'ID!' but value is undefined. Reason: Expected non-null value, found null. (line 1, column 29):\nquery isUser($user_id: ID!, $authorUser_id: ID!) {\n                            ^
Am I doing something wrong here?
m
Your permission query is incorrect I think.
You want to make sure that the user owns the comment?
l
Yes, the authenticated user should be able to create comments for himself only
m
Something like this should work:
Copy code
{
    SomeUserExists(
      filter: {
        id: $user_id
        comments_some: { id: $node_id }
      }
    )
  }
l
Hmm the docs say:
Copy code
For all write operations, all matching permission queries are executed and evaluated before the pending operation
The user doesn't have the comment yet when I'm creating it
Yes, just checked, your query using
comments_some
returns false 😕
Figured it out, my permission was defined as:
Copy code
- operation: Vote.create
  authenticated: true
  query: ./src/permissions/vote/isUser.graphql
But changing it to:
Copy code
- operation: Vote.create
  authenticated: true
- operation: UserOnVote.connect
  authenticated: true
  query: ./src/permissions/vote/isUser.graphql
- operation: PostOnVote.connect
  authenticated: true
Fixed the issue