keystonejs / keystonejs/keystone
Access denied on relationship fields connection
- Dominant language
- TypeScript
- Stars
- 10k
- Forks
- 1.3k
- Avg merge
- 19h 14m
- Merged PRs (30d)
- 19
Description
I am trying to connect images to my object with sudo context.
Used the following code:
```
const context = req.KeystoneContext;
const localDb = context.sudo().db;
try {
await localDb.Motif.updateOne({
where: { sku: '027_DE' },
data: {
isImagesMigrated: true,
images: {
connect: [
{ id: 17674 },
{ id: 17675 },
{ id: 17676 },
{ id: 17677 },
{ id: 17678 }
]
}
}
});
}
catch (error) {
console.log(error);
console.log(error.extensions.debug);
}
```
And I see the following error:
```
GraphQLError: An error occured while resolving relationship fields.
- Motif.images: Access denied: You cannot connect that Image - it may not exist
```
I've tried to link it manually in admin panel then and it is all fine, so it looks like some bug there.

node: v16.20.1
keystone-6/core: v5.5.0
Contributor guide
Research direction
Start from the localDb.Motif.updateOne call, especially the images.connect relationship path, and compare it with the admin panel's successful connection flow. Reproduce the access-denied error with the provided sudo context and identify why the same image records are treated differently; done means the connection succeeds through this API without weakening access controls.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, javascript, node.js
- Domain
- api, authorization, backend, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100