search

jamesedmonston / graphql-authentication

GraphQL authentication for your headless Craft CMS applications.
Other
28 stars 22 forks source link

Public schema field restriction #108

Closed zsavajji closed 1 year ago

zsavajji commented 2 years ago

Hi! I was looking to restrict some fields to an authenticated schema using the field restrictions, but it seems to be not working. The exceptions never get thrown, and i have access to all fields even if marked private.

Is there something i am missing?

Thanks

jamesedmonston commented 2 years ago

@Zsavajji I'll take a look

zsavajji commented 2 years ago

Thank you. Adding on this, i'm able to restrict fields on my restricted schemas, but the public schema restrictions does not take place. If there's no authentication token craft returns the fields using the public schema, even if restrictions are applied.

zsavajji commented 2 years ago

Hi, i went up digging in the code, and found out that you were not checking for any changes on public schema restrictions made in the admin panel, resorting only on the JWT header check. I added a more thorough check on the permissions of the public schema, which should fix these cases.

Let me know :)