payload
payload copied to clipboard
GraphQL: Internal Server Error occurs when querying with hasMany field and its data is filtered by access control
Link to reproduction
https://github.com/ikenox/payload/commit/bd0674af229da5c717a5c469ade7001a2e7d9a9b
Describe the Bug
- Add hasMany relationship. For example, I prepared
Postscollection andTagscollection (Posts has 0-to-many tags) - The following query will cause 500 Error when some
tagsdata is filtered by access control.
Query:
query {
Posts {
docs {
text
tags {
name
}
}
}
}
Result:
{
"errors": [
{
"extensions": {
"name": "Error",
"statusCode": 500
},
"locations": [
{
"line": 6,
"column": 17
}
],
"message": "Something went wrong.",
"path": [
"Posts",
"docs",
0,
"tags",
0
]
}
],
"data": {
"Posts": {
"docs": [
{
"text": "post1",
"tags": null
}
]
}
}
}
Detail of the bug
https://github.com/payloadcms/payload/blob/4c832ad/packages/payload/src/graphql/schema/buildObjectType.ts#L371-L397
At here,
resultwill benullwhen the data is filtered by read-access control.- When
resultisnull, a processresults[i] = ...is skipped.
So, for example, when result is null at i=0, the results array will be [null, data1, ...].
This results array is invalid because it contains null even though the graphql schema type of tags is an array of non-null tag type ([Tag!]) .
To Reproduce
I added a minimum reproducible test. pnpm test:int:postgres _community will fail.
https://github.com/ikenox/payload/commit/bd0674af229da5c717a5c469ade7001a2e7d9a9b
Payload Version
2.18.3
Adapters and Plugins
db-postgres: 0.8.4