"You don't have permission..." when mutation "connect"ing using Int field

1

In the API explorer, if I do a connect: { id: “abc” } in a create mutation, it works and the record is created. If I try to use a different field, which is an Int, it says “You don’t have permission to perform this operation”. Here’s an example:

mutation {
  foobarCreate(data: {
    status: {
      connect: {
        # id: "ck1ljq3zs00um01jkhxd9cagj"
        value: 0
      }
    }
  }) {
    id
  }
}

I notice that “No Duplicate Values” need to be checked for the field to show up. I assume because connect won’t work if there are duplicates.

2

I just noticed something related, where it gives “You don’t have permission…” if the ID doesn’t exist, instead of a more helpful error message

1 Like
3

@mike_ekim1024 @samwoolertonLW For now, this is the expected behavior for security reasons. This error appears when you really don’t have such permissions(permissions for update on both tables in your case) or when an object is not found. FYI we will discuss it and maybe make changes in that behavior.

1 Like
4

I still think this is not correct. If I use “id”, or “title”, it works fine. If I use “value” with 0 (which does exist), which is an Int, I get the security error.

image
image.png498×742 35.6 KB

image
image.png804×504 32.6 KB

1 Like
5

@mike_ekim1024 this seems to be a bug. Let us check.

6

@mike_ekim1024 yeah that’s a bug. Thank you for reporting. I will let you know as soon as we fix it!

1 Like
7

@mike_ekim1024 @samwoolertonLW just want to let you know if is fixed now!

3 Likes