epam / epam/epam-graphql

MutationLoader: `CanSaveAsync` should not call `CanViewAsync`

Open
#6 0 comments 0 reactions 0 assignees View on GitHub
enhancement good first issue
Dominant language
C#
Stars
23
Forks
6
PR merge metrics
No merged PRs in 30d

Description

### Description

CanViewAsync call is not needed here because MutateAsync always checks view rights via ApplySecurityFilter call.
```c#
protected internal virtual async Task CanSaveAsync(IUserContextAccessor context, TEntity entity, bool isNew)
{
if (context == null)
{
throw new ArgumentNullException(nameof(context));
}

if (!await CanViewAsync((GraphQLContext)context, entity).ConfigureAwait(true))
{
return false;
}

return await ((GraphQLContext)context).Registry.CanViewParentAsync(GetType(), (GraphQLContext)context, entity).ConfigureAwait(true);
}
```

### Describe the solution you'd like

Remove redundant call of `CanViewAsync` from `CanSaveAsync`.

Contributor guide

No contributing guide indexed for this repository

Research direction

Locate MutationLoader.CanSaveAsync and read the surrounding mutation authorization flow, including MutateAsync and ApplySecurityFilter. Done means CanSaveAsync no longer calls CanViewAsync while retaining the parent-permission check described in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend-api-design
Issue type
Refactor
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.