amplication / amplication/amplication

As a User - I want my generated code to use the best practices on ACLs in Nestjs

Open
#6,779 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
16k
Forks
1.5k
PR merge metrics
No merged PRs in 30d

Description

At the moment, the generated code uses `AclValidateRequestInterceptor` and `AclFilterResponseInterceptor` to validate user permissions on entities and fields.

As per NestJs best practices, we should use Guards instead as they are meant for authentication, roles permissions and ACLs.
Guards are also run before any interceptor, pipe or filters, releasing the server from useless tasks.
https://docs.nestjs.com/faq/request-lifecycle#summary

## `AclValidateRequestInterceptor`
Should be migrated to a Guard

## `AclFilterResponseInterceptor`

This interceptor is conceptually wrong since it change the behaviour of the results on the basis of user permissions.
As best practices, the response to a request should contain either the expected result of an error stating the missing permissions.

i.e.
on a request for a client that has read permissions only on user name like
```graphql
query user {
name
email
}
```

current result doesn't let the client that it did not have access to email
```graphql
data: {
user: {
name
}
}
```

expected result will look something like this
```graphql
data: {
user: {
name
}
},
errors: [
{
"message": "Unauthorized to access user.email "
// ...additional fields...
}
]
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.