Multiple @can directive requires to have all privileges
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.5k
- Forks
- 468
- Avg merge
- 3h 9m
- Merged PRs (30d)
- 2
Description
Hi,
@can directive is market as REPEATABLE, but now when we have schema like:
updatePost(id: ID!, input: PostInput! @spread): Post
@update
@guard
@can(
ability: "update all posts"
)
@can(
ability: "update own post"
find: "id"
)
User must have two abilities to run migration. It is quite not logical, because now it is locking both: administrator with all privileges and owner with privileges to edit own posts.
Maybe good idea is directive @can should work like "OR", and new directive (maybe @must ?) should work like "AND" in privileges. What do you think?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the repeatable @can directive behavior in the schema example. First resolve whether repeated @can directives should use OR semantics and whether a separate AND-style directive is needed; done means the chosen privilege semantics are implemented and covered by tests for administrator and own-post access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, laravel, php
- Domain
- api, authorization, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100