Open heyweswu opened 4 weeks ago
vercel[bot]
commented
4 weeks ago The latest updates on your projects. Learn more about Vercel for Git ↗︎
| Name | Status | Preview | Comments | Updated (UTC) |
|---|---|---|---|---|
| zenstack-new-site | ✅ Ready (Inspect) | Visit Preview | 💬 Add feedback | Sep 11, 2024 9:11pm |
coderabbitai[bot]
commented
4 weeks ago The changes introduce a new section in the documentation that details the use of other model fields within field-level policies. It highlights the importance of including all relevant fields in the select query for proper evaluation of the policy. The documentation clarifies that omitting a field from the select query results in the policy evaluating to false, which prevents data retrieval. Two illustrative examples are provided to demonstrate the impact of field inclusion on query results.
| Files | Change Summary |
|---|---|
docs/the-complete-guide/part1/4-access-policy/4.7-field-level.md |
Added a section on "Using other model fields within Field-Level Policies" explaining field inclusion in select queries. Included examples demonstrating the effects of field inclusion on query results. |
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
ymc9
commented
4 weeks ago Hi @heyweswu , thanks for making this PR. Actually the fields referenced in the field-level rules are supposed to be automatically included. Let me check if it's actually a bug.
heyweswu
commented
4 weeks ago Hi @heyweswu , thanks for making this PR. Actually the fields referenced in the field-level rules are supposed to be automatically included. Let me check if it's actually a bug.
@ymc9 Sounds good thank you for checking. Let me know if I can help! I dug down into some generated code and found a guard function looking like this:
function User$lastName_read(input, context) {
return (((input === null || input === void 0 ? void 0 : input.organizationId) == 'organization123'));input if I followed correctly was being passed entity from checkReadField. And entity was always only the specific fields in a given select of a query.
For example in the below query:
db.user.findMany({
select: {
lastName: true
}
})entity would come back as:
{
lastName: 'Smith'
}@ymc9 another detail/question we ran into today: If we have both model level and field level policies is there a way to fall back onto the model level policy if the field level policy evaluates to false (override set to true)? Or is it that if we set override to true we need to provide all the policy logic to allow read within the field-level allow?
ymc9
commented
3 weeks ago @ymc9 another detail/question we ran into today: If we have both model level and field level policies is there a way to fall back onto the model level policy if the field level policy evaluates to false (override set to true)? Or is it that if we set override to true we need to provide all the policy logic to allow read within the field-level allow?
Hi @heyweswu , the "override" parameter allows a field to be accessed even if the entire entity cannot be accessed. It's explained in more details here: https://zenstack.dev/docs/the-complete-guide/part1/access-policy/field-level#overriding-model-level-policies There isn't a way to fall back from field-level to model-level yet. You can consider creating a github feature request for it.
ymc9
commented
3 weeks ago Hi @heyweswu , thanks for making this PR. Actually the fields referenced in the field-level rules are supposed to be automatically included. Let me check if it's actually a bug.
@ymc9 Sounds good thank you for checking. Let me know if I can help! I dug down into some generated code and found a guard function looking like this:
function User$lastName_read(input, context) { return (((input === null || input === void 0 ? void 0 : input.organizationId) == 'organization123'));
inputif I followed correctly was being passedentityfrom checkReadField. Andentitywas always only the specific fields in a givenselectof a query.For example in the below query:
db.user.findMany({ select: { lastName: true } })
entitywould come back as:{ lastName: 'Smith' }
Hey @heyweswu , back to the original problem, I couldn't seem to reproduce the issue with a simple project. Do you have a sharable repro project? Thanks!
Stumbled upon this behavior when working on an application but didn't see it documented. Not super intuitive so I thought I would try to explain what I was experiencing. Open to any word-smithing you all may feel is necessary!
Summary by CodeRabbit