When a block is disabled, it still comes back in the GQL response

verbb / vizy

A flexible visual editor for Craft CMS

Other

43 stars 8 forks source link

When a block is disabled, it still comes back in the GQL response #120

Closed tremby closed 2 years ago

tremby commented 2 years ago

Description

I'm not sure if this is intended or not, but if I flip the "enabled" toggle to off, the data about that block still comes through when querying the GQL endpoint.

I would expect them not to show up. Having the disabled ones show up means

If the developer doesn't think to code in a conditional for it, the end user ends up seeing stuff they're not meant to
Data which is switched off in the CMS is publicly available (presuming you've got a public GQL endpoint available, which is common for client-side web apps), which could be bad for various reasons
Responses are bigger than they need to be

Steps to reproduce

Flip a block to off
Query for the vizy field
See the disabled block is present, with "enabled" marked as false

Additional info

Plugin version: craft-4 7e28546
Craft version: 4.0.x-dev 6a88060
Multi-site: Yes

Additional context

Headless mode

engram-design commented 2 years ago

Yeah, good point. I suppose by default it should only come back with the enabled ones, and allow you to provide an argument on status to override that. I'm happy enough with this being a breaking change, as from a front-end perspective, you really have very little need for disabled nodes/blocks.

But taking it one step further, we should introduce querying via:

nodes(where: "{ \"type\": \"paragraph\" }", limit: 2) {

}

That's added/fixed for the next release. To get this early, change your verbb/vizy requirement in composer.json to:

"require": {
  "verbb/vizy": "dev-craft-3 as 1.0.12",
  "...": "..."
}

Then run composer update.

tremby commented 2 years ago

I personally would actually prefer it to not be possible to retrieve disabled blocks, at least without having access to a GQL schema which specifically allows it. In my mind retrieving disabled blocks is akin to retrieving a draft version of the page -- it's not meant to be available to the public.

Or is that not what enabled/disabled is meant for? What's the purpose, if not?

Looking forward to disabled ones not coming through (at least by default) in the Craft 4 branch.

Thanks again.

engram-design commented 2 years ago

I largely agree - but just keeping it possible to serve somewhat as backward compatibility (in case anyone is using disabled blocks - for whatever reason.

Will be sure to bring the craft-4 branch up to speed soon.

engram-design commented 2 years ago

Fixed in 1.0.13 and 2.0.0-beta.3