Graphql-shield: or rule not working

[mhaagens]

Bug report

• [X] I have checked other issues to make sure this is not a duplicate.

Describe the bug

Using an "or" fails to run all rules.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

(Delete the filler code and replace it with your own)

1. This is my GraphQL Schema.

type Query {
  hello: String
}

1. This is the invoked query

hello

1. I use these permissions

const permissions = shield({
  Query: {
    hello: or(rules.isSuperAdmin, rules.isCompanyManager),
  }
})

1. This is the error I see

Not Authorised!

Expected behavior

Expected to be granted permission as isCompanyManager returns true.

Additional context

Here are the rule definitions used;

export const rules = {
  isSuperAdmin: rule(options)(async (_, args, ctx, info) => {
    const res = ctx.req.user.permissions.filter(
      e => e.group === "superAdmin"
    ).length
      ? true
      : false;
    return res;
  }),
  isCompanyManager: rule(options)(async (_, args, ctx, info) => {
    const res = ctx.req.user.permissions.filter(
      e => e.group === "companyManager"
    ).length
      ? true
      : false;
    return res;
  })
};

[open-collective-bot[bot]]

Hey @mhaagens :wave:,

Thank you for opening an issue. We will get back to you as soon as we can. Also, check out our Open Collective and consider backing us.

https://opencollective.com/graphql-shield

PS.: We offer priority support for all backers. Don't forget to add priority label when you start backing us :smile:

[mhaagens]

I actually can't get any rules to work when there's more than one;

hello: and(
  rules.isAuthenticated,
  or(
    rules.isSuperAdmin, 
    rules.isCompanyManager
  )
)

grants access, but the user in this case is not superAdmin or companyManager.

[mhaagens]

Sooo...i wrote no-cache instead of no_cache, thats why it broke. My bad!

[seawatts]

I'm actually getting the same error. Setting cache type doesn't help.

__Update__: It actually only works when I don't try to reference parent or args.

__Update 2__: There was actually an exception being thrown 😬in the rule.

It would be nice to be able to see the output of the error being thrown.

[maticzav]

Could you try using debug and post the result here?

[enbermudas]

This is happening to me with the next rule:

const isAdmin = rule({ cache: 'contextual' })(
  async (parent, args, ctx, info) => {
    const role = await Role.findOne({ slug: 'administrator' });
    console.log(ctx.user.roleId === role.id);
    return ctx.user.roleId === role.id;
  }
);

Funny thing is, this console log actually display true, so the userCreate permission should work, right?

const permissions = shield({
  Query: {},
  Mutation: {
    ...
    // User
    userCreate: isAdmin,
    ....
  }
});

Well, it doesn't. And it displays the Not Authorised! message.

[maticzav]

You should try setting User to allow as well. I am quite confident that the server executes the mutation and only hides the result.

Note that rule itself doesn't "know" anything about the return type - you have to set up permissions for that type as well.