-
-
Notifications
You must be signed in to change notification settings - Fork 468
Fine Controlled Access to Related Models using @canResolved with RETURN_VALUE #2700
I'm trying to 'protect' models that are loaded via the relationships of a parent type, to ensure that the user has access to the data.
My example could be seen as follows:
type Order @node { id: ID! @globalId ... bills: [Bill!]! @hasMany @canResolved(ability: "viewAny", action: RETURN_VALUE, returnValue: "Something")
This is sort of working, in that it's throwing an error "This action is unauthorized" if the user cannot access the bills, but I'm trying to return a different value in it's place, rather than just throwing a total unauthorized error message.
N.B. I'm not sure if the order of the directives matters generally, but I have tried changing the order to no avail.
Anyone got any hints on how to do this?
Thanks in advance.
All reactions
Replies: 2 comments 5 replies
I would suggest something like this:
type Order @node { id: ID! @globalId ... bills: [Bill!]! @method(name: "billsWithAuthorization") @with(relation: "bills")
Then, on your Order model, add a method billsWithAuthorization that implements the logic you want.
All reactions
Thanks @spawnia - so reading between the lines, the action and returnValue are only useable on simple types and not on relationships?
All reactions
You can try to return a complex value too, returnValue can be any GraphQL literal.
All reactions
I did give that a try, but does it need to satisfy the type definition? i.e., Bill in this example?
All reactions
It does, that's what I mean. Do something like returnValue: [{ id: 'dummy', ...}].