https://www.prisma.io/ logo
Join Slack
Powered by
```query ($input_courseId: ID!, $user_id: ID!) { ...
# prisma-whats-new
l
Copy code
query ($input_courseId: ID!, $user_id: ID!) {
 SomeUserExists(
   filter: {
    id: $user_id,
     OR: [{
         ownedCourses_some: {
           id: $input_courseId
         }
       },
         {
         role:ADMIN
       }]
   }
 )
}
j
Is this query on a .graphql file?
l
No, it is a permission query entered into the web GUI
d
I can replicate this behaviour using your permission query and (I assume) a similar schema
what type and operation are you putting the permission on?
l
Here's the type:
Copy code
type Assignment implements Node {
  id: ID! @isUnique
  createdAt: DateTime!
  updatedAt: DateTime!
  title: String!
  course: Course @relation(name: "CourseOnAssignment")
  author: User! @relation(name: "AuthorOnAssignment")
  questions: [Question!]! @relation(name: "AssignmentQuestions")
  questionType: QuestionType! @defaultValue(value: MULTIPLE_CHOICE)
  concepts: [Concept!]! @relation(name: "AssignmentOnConcepts")
  quiz: Quiz @relation(name: "AssignmentOnQuiz")
  numCreateQuestions: Int! @defaultValue(value: 1)
  numReviewQuestions: Int! @defaultValue(value: 3)
  numResponseQuestions: Int! @defaultValue(value: 10)
  numGradeResponses: Int! @defaultValue(value: 3)
}
d
which operation are you putting the permission query on Create?
l
I believe so, I'm trying to make sure that was it
Yes, create
The same behavior as explained happens. I put in the first query, update the permission, then when I go to look at it it has the second strange query that has errors in the GUI
Thanks for helping!
d
I can confirm that I get the same behaviour - no apparent error in the query but then after saving it, reopening it shows a broken version.
So I think you have definitely found a bug
l
Excellent...kind of
d
The right place to report bugs to the graph.cool team is here: https://github.com/graphcool/api-bugs/issues
But in the meantime you need a workaround...
l
Yes, definitely
d
You could do a permission on the AssignMent-Course relationship rather than the creation of the Assignment. Something like: query ($user_id: ID!, $courseCourse_id: ID!) { SomeUserExists( filter: { id: $user_id, OR: [{ ownedCourses_some: { id: $courseCourse_id } }, { role:ADMIN }] } ) }
I think this would cause a create of an Assignment to fail if the user was not an admin and was not the owner of the course
l
I'll take a look at this, thank you
d
And if you used this on both Connect and Disconnect for the relationship, users would also be prevented from moving assignments away from courses they did not own (as the disconnect permission would fail)
Permissions on Types (e.g. update) are not triggered when only a relationship changes, so you would probably want a permission on the relationship in any case
👍 1
l
I've got some good news. If I can generalize the experience I just had, it looks like the permission still works after saving it, it's just the GUI that displays the permission query incorrectly
Open in Slack
PreviousNext
Powered by