Check auth definition on wrong node

[Andy2003]

It seems that the following condition is wrong:

https://github.com/neo4j/graphql/blob/296574085021165d57dd9d7adea8da2890444611/packages/graphql/src/translate/create-update-and-params.ts#L157-L168

A check for refNode.auth should be used instead.

[neo4j-team-graphql]

Many thanks for raising this bug report @Andy2003. :bug: We will now attempt to reproduce the bug based on the steps you have provided.

Please ensure that you've provided the necessary information for a minimal reproduction, including but not limited to:

• Type definitions
• Resolvers
• Query and/or Mutation (or multiple) needed to reproduce

If you have a support agreement with Neo4j, please link this GitHub issue to a new or existing Zendesk ticket.

Thanks again! :pray:

[tbwiss]

Hi @Andy2003! Thanks for raising this! Would you be able to elaborate a bit more on why? It would be helpful if you could add a (use) case. Thank you!

[Andy2003]

While going through the code (due to java portation), I noticed that the mentioned call to createAuthAndParams is made with the entity-parameter set to refNode, but around the call a check for the existence nodes - auth-object is done instead checking for refNodes auth. This looks like a bug to me. I do not have a concrete test case. In other places in the code, however, the same object which is passed as entity to createAuthAndParams is always checked for its existence beforehand.

[darrellwarde]

This should now certainly be resolved in the new authorization features of the library in 3.23.0. 🙂