Set isFilterable to false in examples where read access is false

[borisno2]

Both the basic and custom-sesson-validation examples have fields with field-level access control that don't allow reads, this PR also sets those fields to isFilterable: false

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated
keystone-next-docs	✅ Ready (Inspect)	Visit Preview	Jan 15, 2023 at 10:32PM (UTC)

[codesandbox-ci]

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit 04025f7:

Sandbox	Source
@keystone-6/sandbox	Configuration

[dcousens]

Any thoughts about

• keystone/examples/nextjs-keystone/src/keystone/schema.ts

  Line 30 in 04025f7

  read: permissions.authenticatedUser,

• https://github.com/keystonejs/keystone/blob/04025f747cf4a65a6b80e11594f880e393396358/docs/pages/docs/guides/auth-and-access-control.md#create-a-list-for-users

[borisno2]

Any thoughts about

• keystone/examples/nextjs-keystone/src/keystone/schema.ts

  Line 30 in 04025f7

  read: permissions.authenticatedUser,

• https://github.com/keystonejs/keystone/blob/04025f747cf4a65a6b80e11594f880e393396358/docs/pages/docs/guides/auth-and-access-control.md#create-a-list-for-users

The first one requires filtering for auth to work - this is where isFilterable: false would be too blunt - this would generally fall to list filtering however in this example it is allowAll on read, so not the most security-centered example. If I was writing something like this where some parts of user needed to be public, I would separate those out into a separate list, and if required, use virtual fields to not replicate data.

As for the guide maybe this needs some rework to align with some "best practices", ie there is no access control at all on the User list. I would also generally recommend separate lists for User Authentication/Authorization and Application concerns with the Auth list completely locked down at the list level.