nuwave / nuwave/lighthouse

Model is not found when a field other than id specified for authorization

Open
#1,435 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

discussion
Dominant language
PHP
Stars
3.5k
Forks
468
Avg merge
3h 9m
Merged PRs (30d)
2

Description

Hello. I'm trying to fetch a model by a field that's not id to check if the authenticated user is has the permission to view it. Consider the following scenario:

The database has the tables named users and sites and a user can view a site only if they belong to the site. So, the database structure is roughly as follows:

users
----------
id
name
site_id
*other fields*
sites
----------
id
domain
*other fields*

My authorization check defined in AuthServiceProvider.php is as follows:

        Gate::define('view site', function ($user, Site $site) {
            return $user->site_id === $site->id;
        });

So, when I define the query like site(id: ID! @eq): Site @find @can(ability: "view site" find: "id"), everything works just fine, but when it's site(domain: String! @eq): Site @find @can(ability: "view site" find: "domain"), I get an error saying "No query results for model [App\Site] example".

Does find work only with primary keys? The api reference in the docs goes like:

"""
  The name of the argument that is used to find a specific model
  instance against which the permissions should be checked.
"""
  find: String

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with AuthServiceProvider.php and the schema examples, then trace how the @find and @can directives handle the find argument. Reproduce the working id case and failing domain case; done means non-primary-key lookup behavior is corrected or clearly documented as unsupported, with the API reference updated if needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, laravel, php
Domain
api, authorization, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.