payloadcms / payload

Payload is the open-source, fullstack Next.js framework, giving you instant backend superpowers. Get a full TypeScript backend and admin panel instantly. Use Payload as a headless CMS or for building powerful applications.
https://payloadcms.com
MIT License
25.64k stars 1.63k forks source link

GraphQL Error for hasMany relation where some records are denied read access, but others are not #9236

Open 6TELOIV opened 2 hours ago

6TELOIV commented 2 hours ago

Describe the Bug

When using access control to restrict access to a collection, the GraphQL api will give errors and not return the correct data if some but not all records are denied readability in a relation field with many related records.

If all are read-allowed, it works fine. If all are denied, it's also fine. But if some are allowed and some are not, it returns null for the entire field.

Link to the code that reproduces this issue

https://github.com/6TELOIV/graphql-null-relations

Reproduction Steps

  1. Run the server on your local machine with a local PostgreSQL DB
  2. On the DemoGlobal, add multiple related Demo items, checking visible on some but not others.
  3. Visit localhost:3000/api/graphql-playground in a private window/logged out context
  4. Input the following query:
    query demo {
      DemoGlobal {
        demoRelationship {
          id
        }
      }
    }
  5. Observe the error:

    Error: Cannot return null for non-nullable field DemoGlobal.demoRelationship.

    {
      "errors": [
        {
          "extensions": {
            "name": "Error",
            "statusCode": 500
          },
          "locations": [
            {
              "line": 3,
              "column": 5
            }
          ],
          "message": "Something went wrong.",
          "path": [
            "DemoGlobal",
            "demoRelationship",
            1
          ]
        }
      ],
      "data": {
        "DemoGlobal": {
          "demoRelationship": null
        }
      }
    }

Which area(s) are affected? (Select all that apply)

area: core, db-postgres

Environment Info

Payload: 3.0.0-beta.130
Node: 22.11.0
NextJS: 15.0.0
6TELOIV commented 2 hours ago

Initial investigation and details present in this discord thread: https://discord.com/channels/967097582721572934/1307023111056785418

It seems to maybe be an inconsistent issue, but that min repro seems to consistently have the issue.