https://www.prisma.io/ logo
Join Slack
Powered by
I have a type that for some users have no nodes. R...
# prisma-whats-new
v
I have a type that for some users have no nodes. Running a query on this node for those users yields me an "Insufficient Permissions" error instead of an empty array. Is this expected behaviour or is my permission query the culprit? Read permission query for the Company type, applied on all fields:
Copy code
query ($user_id: ID!, $node_id: ID!) {
  SomeCompanyExists(
    filter: {
      id: $node_id,
      owner: {
        id: $user_id
      }
    }
  )
}
d
I don't get that behaviour
Schema:
type Company implements Node { createdAt: DateTime! dummy: String! id: ID! @isUnique owner: User @relation(name: "CompanyOnUser") updatedAt: DateTime! }
Permission query:
query ($node_id: ID!, $user_id: ID!) { SomeCompanyExists( filter: { id: $node_id, owner: { id: $user_id } } ) }
Query:
query{ allUsers{ id companies{ id dummy } } }
Result:
Copy code
{
  "data": {
    "allUsers": [
      {
        "id": "cj7085lpl8szi0143vvmf14yw",
        "companies": []
      },
      {
        "id": "cj7086klwduv60131gyv4ytd3",
        "companies": []
      }
    ]
  }
}
I get the same result whether I run the query as admin or as a user
What does your query look like?
v
my query looks like:
Copy code
query {
  allCompanies {
    id
    name
  }
}
d
Ah, that would explain why you are getting the permission error then
Your permission query for reading a company requires there to be a user there
but you are trying to query for companies that have no user
you will have to chage your permission query, add anotehr permission for this situation or filter out the companies with no owner in your query
I'm a bit confused though - you said you expected to get an empty array back from your query. Why are you expecting allCompanies to return an empty array when you have some companies?
or are you epxecting only those the user has permission on to be returned?
If so, permissions dont work like that - they don't filter results for you automatically. You have to make sure only things that are allowed are requested (e.g. by using a filter)
for example, in this situation, the only companies the user is allowed to see are those that they own, so why not just query for that:
query{ user{ companies{ id dummy } } }
v
Sorry, been away for a while taking care of life in general (& family). That is correct, I assumed I could use the permission system to only get the company nodes belonging to the logged user. I'll use the user query instead, just as you suggest. Thank you for your time! Much appreciated
Open in Slack
PreviousNext
Powered by