Hello! I'm trying to implement Permissions on obje...
# prisma-whats-new
s
Hello! I'm trying to implement Permissions on objects in my schema (almost exactly like this example: https://www.graph.cool/docs/tutorials/authorization-content-management-system-miesho4goo/#elevated-access-for-owners); however, when I query in the Playground I never get the expected behavior (data is filtered by the 'owner'). I would assume that the Playground would respect those Permissions and that's where I should go to test this but wanted to validate that I'm right? Any additional guidance that someone could provide would be very much appreciated.
n
@soonertrent hey, the playground allows you to run rqeuests as a specific user, or as
ADMIN
that can access veveryhing
the default is
ADMIN
s
@nilan - yep, and I'm trying to run as a specific user to validate that but I'm never getting data back; it's almost as if the query isn't finding data to validate against. In the an attempt to re-create the example from that blog post I've built out Document and mapped to User; on the Read I've put in the following filter but no luck:
Copy code
query ($node_id: ID!, $user_id: ID!) {
  SomeDocumentExists(
    filter: {
      id: $node_id
      owner:{
        id: $user_id
      }
    })
}
@nilan - this should be an exact replication of the example in the blog post so I'm nots sure where I'm going wrong.
n
Ah so just reading what you're describing again - permissions do not filter queries, they prevent access and return a permission error instead
what's the query you run and what's the response?
s
Here's my query:
{ allDocuments{ id title owner { id firstName } } }
So I thought that Permissions would return only the data that a user had a Permission to see - almost like row-level security in SQL terms
But it sounds like what you're saying is that it's either going to give the data or restrict the return of that node of data based upon the Permission.
n
So I thought that Permissions would return only the data that a user had a Permission to see
that's not the case - it's very simple to use the same filter logic in the query as in the permission query though
either use the filter on
allDocuments(filter: { owner: { id: "some-id" } }) { id }
or start with the
user
query
s
Okay that makes sense - I read the articles/webinars like it would do the filtering for me. My mistake. Thanks.
n
Cheers! 🙂 It's an obvious thought but not how it works right now -- let me know if you need anything else 🙂