You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When you use relation fields in query filters, ZenStack automatically injects the policies for the related model, so that the policies are still effective even if you're only filtering but not retrieving data.
The result will be filtered to exclude posts whose author field (User) is not readable. The reasoning is since you can't read the author field, you can't access its role field, so the role: 'Author' filter will evaluate to false.
However, the automatic relation filtering doesn't respect field-level access policies yet. There are two aspects about this problem:
If the related model is readable but some of the fields used to filter are not (due to field-level policies), ZenStack should behave as if the model were not readable.
If the related model is NOT readable but all of the fields used to filter are readable (due to field-level override policies), ZenStack should behave as if the model were readable.
When you use relation fields in query filters, ZenStack automatically injects the policies for the related model, so that the policies are still effective even if you're only filtering but not retrieving data.
E.g., for model:
If you query with:
The result will be filtered to exclude posts whose author field (
User
) is not readable. The reasoning is since you can't read the author field, you can't access itsrole
field, so therole: 'Author'
filter will evaluate to false.However, the automatic relation filtering doesn't respect field-level access policies yet. There are two aspects about this problem:
The text was updated successfully, but these errors were encountered: