From d1bb2c604668003443f590e62a38051d0696d036 Mon Sep 17 00:00:00 2001 From: rijkvanzanten Date: Mon, 26 Oct 2020 11:51:14 +0100 Subject: [PATCH] Fix relational fetching in graphql endpoint Fixes #769 --- api/src/services/graphql.ts | 6 ++---- api/src/services/relations.ts | 3 +++ 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/api/src/services/graphql.ts b/api/src/services/graphql.ts index d3f54fdee2..1cc3864f8a 100644 --- a/api/src/services/graphql.ts +++ b/api/src/services/graphql.ts @@ -18,7 +18,6 @@ import { GraphQLInputObjectType, ObjectFieldNode, GraphQLID, - ValueNode, FieldNode, GraphQLFieldConfigMap, GraphQLInt, @@ -26,11 +25,9 @@ import { StringValueNode, BooleanValueNode, ArgumentNode, - GraphQLScalarType, GraphQLBoolean, ObjectValueNode, GraphQLUnionType, - GraphQLUnionTypeConfig, } from 'graphql'; import { getGraphQLType } from '../utils/get-graphql-type'; import { RelationsService } from './relations'; @@ -65,7 +62,7 @@ export class GraphQLService { this.knex = options?.knex || database; this.fieldsService = new FieldsService(options); this.collectionsService = new CollectionsService(options); - this.relationsService = new RelationsService({ knex: this.knex }); + this.relationsService = new RelationsService(options); } args = { @@ -138,6 +135,7 @@ export class GraphQLService { const relatedIsSystem = relationForField.one_collection!.startsWith( 'directus_' ); + const relatedType = relatedIsSystem ? schema[relationForField.one_collection!.substring(9)].type : schema.items[relationForField.one_collection!].type; diff --git a/api/src/services/relations.ts b/api/src/services/relations.ts index c8c17a182f..9b08c1b964 100644 --- a/api/src/services/relations.ts +++ b/api/src/services/relations.ts @@ -25,7 +25,9 @@ export class RelationsService extends ItemsService { | ParsedRelation | ParsedRelation[] | null; + const filteredResults = await this.filterForbidden(results); + return filteredResults; } @@ -58,6 +60,7 @@ export class RelationsService extends ItemsService { this.accountability?.role || null, 'read' ); + const allowedFields = await this.permissionsService.getAllowedFields( this.accountability?.role || null, 'read'