[permissions] Adapt FE to non-readable fields (#13440)
Fixes https://github.com/twentyhq/core-team-issues/issues/1261 and https://github.com/twentyhq/core-team-issues/issues/1153 In this PR we - remove fields user do not have read access on from queries (findMany, findDuplicates, returned fields from create or update etc.) - remove fields user do not have read access on from views This is behind a feature flag
This commit is contained in:
+9
-6
@@ -64,9 +64,18 @@ export class GraphqlQueryFindDuplicatesResolverService extends GraphqlQueryBaseR
|
||||
|
||||
let objectRecords: Partial<ObjectRecord>[] = [];
|
||||
|
||||
const columnsToSelect = buildColumnsToSelect({
|
||||
select: executionArgs.graphqlQuerySelectedFieldsResult.select,
|
||||
relations: executionArgs.graphqlQuerySelectedFieldsResult.relations,
|
||||
objectMetadataItemWithFieldMaps,
|
||||
});
|
||||
|
||||
if (executionArgs.args.ids) {
|
||||
objectRecords = (await existingRecordsQueryBuilder
|
||||
.where({ id: In(executionArgs.args.ids) })
|
||||
.setFindOptions({
|
||||
select: columnsToSelect,
|
||||
})
|
||||
.getMany()) as ObjectRecord[];
|
||||
} else if (executionArgs.args.data && !isEmpty(executionArgs.args.data)) {
|
||||
objectRecords = executionArgs.args.data;
|
||||
@@ -92,12 +101,6 @@ export class GraphqlQueryFindDuplicatesResolverService extends GraphqlQueryBaseR
|
||||
});
|
||||
}
|
||||
|
||||
const columnsToSelect = buildColumnsToSelect({
|
||||
select: executionArgs.graphqlQuerySelectedFieldsResult.select,
|
||||
relations: executionArgs.graphqlQuerySelectedFieldsResult.relations,
|
||||
objectMetadataItemWithFieldMaps,
|
||||
});
|
||||
|
||||
const duplicateRecordsQueryBuilder =
|
||||
executionArgs.repository.createQueryBuilder(
|
||||
objectMetadataItemWithFieldMaps.nameSingular,
|
||||
|
||||
Reference in New Issue
Block a user