Skip to content

Field level access policy doesn't overide the default deny behavior  #1014

Closed
@jiashengguo

Description

@jiashengguo

It shows ACCESS_POLICY_VIOLATION error when trying to update authorId.

  model Post {
    id Int @id() @default(autoincrement())
    title String
    content String?
    author User? @relation(fields: [authorId], references: [id])
    authorId Int? @allow('update', true, true)

    @@allow('read', true)
  }

It works if adding an arbitrary update policy that never fulfill like @@allow('update', content == "123")

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions