payload icon indicating copy to clipboard operation
payload copied to clipboard

GraphQL: Internal Server Error occurs when querying with hasMany field and its data is filtered by access control

Open ikenox opened this issue 1 year ago • 0 comments

Link to reproduction

https://github.com/ikenox/payload/commit/bd0674af229da5c717a5c469ade7001a2e7d9a9b

Describe the Bug

  1. Add hasMany relationship. For example, I prepared Posts collection and Tags collection (Posts has 0-to-many tags)
  2. The following query will cause 500 Error when some tags data is filtered by access control.

Query:

query {
  Posts {
    docs {
      text
      tags {
        name
      }
    }
  }
}

Result:

{
  "errors": [
    {
      "extensions": {
        "name": "Error",
        "statusCode": 500
      },
      "locations": [
        {
          "line": 6,
          "column": 17
        }
      ],
      "message": "Something went wrong.",
      "path": [
        "Posts",
        "docs",
        0,
        "tags",
        0
      ]
    }
  ],
  "data": {
    "Posts": {
      "docs": [
        {
          "text": "post1",
          "tags": null
        }
      ]
    }
  }
}

Detail of the bug

https://github.com/payloadcms/payload/blob/4c832ad/packages/payload/src/graphql/schema/buildObjectType.ts#L371-L397

At here,

  • result will be null when the data is filtered by read-access control.
  • When result is null, a process results[i] = ... is skipped.

So, for example, when result is null at i=0, the results array will be [null, data1, ...]. This results array is invalid because it contains null even though the graphql schema type of tags is an array of non-null tag type ([Tag!]) .

To Reproduce

I added a minimum reproducible test. pnpm test:int:postgres _community will fail. https://github.com/ikenox/payload/commit/bd0674af229da5c717a5c469ade7001a2e7d9a9b

Payload Version

2.18.3

Adapters and Plugins

db-postgres: 0.8.4

ikenox avatar May 27 '24 05:05 ikenox