MutationLoader: `CanSaveAsync` should not call `CanViewAsync`
- Dominant language
- C#
- Stars
- 23
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Description
### Description
CanViewAsync call is not needed here because MutateAsync always checks view rights via ApplySecurityFilter call.
```c#
protected internal virtual async Task CanSaveAsync(IUserContextAccessor context, TEntity entity, bool isNew)
{
if (context == null)
{
throw new ArgumentNullException(nameof(context));
}
if (!await CanViewAsync((GraphQLContext)context, entity).ConfigureAwait(true))
{
return false;
}
return await ((GraphQLContext)context).Registry.CanViewParentAsync(GetType(), (GraphQLContext)context, entity).ConfigureAwait(true);
}
```
### Describe the solution you'd like
Remove redundant call of `CanViewAsync` from `CanSaveAsync`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Locate MutationLoader.CanSaveAsync and read the surrounding mutation authorization flow, including MutateAsync and ApplySecurityFilter. Done means CanSaveAsync no longer calls CanViewAsync while retaining the parent-permission check described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- backend-api-design
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100