Closed sam-hunt closed 7 years ago
The issue is traplineuser records being joined to get the admin flag for the can_edit return field. They've been selected straight onto the record, rather than being filtered first and just the flag added.
These are actually quite difficult, requiring joins as GET can return multiple entities, each of which may have different permissions.
Can no longer duplicate the issue on prod, using the unaltered db records. Seems the fix was successful, can reopen later if not.
Likely related to the most recent GET query changes in #173. Tables known to have this issue so far: trap, trapline, trapline-user Quite likely an issue related to joining trapline-user.