How to handle permissions when not casting to a Doctype about umbraco-graphql HOT 3 CLOSED

As discussed I believe the issue here is we loop over and store the doctype name in the meta data and use that to build up the Claims key (ie "docType:Field:Permission" so "Homepage:pageTitle:read"). But when we use the contentBy stuff it doesn't have that meta data available. If we could get it injected in then it should "just work" but that would require that we do a look up to get the data (ie resolve it) before we check the authentication (which is currently done with a filter which fires before we resolve).

Bit of a chicken and egg situation.

from umbraco-graphql.

I guess the problem is that the validation rules is run against the query (which doesn't know the correct types).

One solution is to move the auth to a field middleware since they are run at execution time and at that point we know which type that's gonna be returned.

But if we #20 are getting implemented I'm not sure if this is gonna be a problem since you'll only get the schema you'll have access to and it'll just fail if you try to query for a field that "doesn't exist"

from umbraco-graphql.

Closing this for now as I've removed the permissions for now

from umbraco-graphql.