keystonejs / keystonejs/keystone

Access denied on relationship fields connection

Open
#8,759 1 comment 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
10k
Forks
1.3k
Avg merge
19h 14m
Merged PRs (30d)
19

Description

I am trying to connect images to my object with sudo context.
Used the following code:
```
const context = req.KeystoneContext;
const localDb = context.sudo().db;

try {
await localDb.Motif.updateOne({
where: { sku: '027_DE' },
data: {
isImagesMigrated: true,
images: {
connect: [
{ id: 17674 },
{ id: 17675 },
{ id: 17676 },
{ id: 17677 },
{ id: 17678 }
]
}
}
});
}
catch (error) {
console.log(error);
console.log(error.extensions.debug);
}
```

And I see the following error:
```
GraphQLError: An error occured while resolving relationship fields.
- Motif.images: Access denied: You cannot connect that Image - it may not exist
```

I've tried to link it manually in admin panel then and it is all fine, so it looks like some bug there.

![Screenshot from 2023-08-11 10-30-11](https://github.com/keystonejs/keystone/assets/28062183/b2f35f46-1233-4eee-8244-c646931d00e1)

node: v16.20.1
keystone-6/core: v5.5.0

Contributor guide

Open the contributing guide

Research direction

Start from the localDb.Motif.updateOne call, especially the images.connect relationship path, and compare it with the admin panel's successful connection flow. Reproduce the access-denied error with the provided sudo context and identify why the same image records are treated differently; done means the connection succeeds through this API without weakening access controls.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, javascript, node.js
Domain
api, authorization, backend, database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.