note for using model fields in field-level policies

[heyweswu]

Stumbled upon this behavior when working on an application but didn't see it documented. Not super intuitive so I thought I would try to explain what I was experiencing. Open to any word-smithing you all may feel is necessary!

Summary by CodeRabbit

• Documentation
  • Introduced a new section on using other model fields within field-level policies, clarifying the importance of including all relevant fields in select queries to ensure correct policy evaluation.
  • Added examples to illustrate the impact of field inclusion on data retrieval outcomes.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
zenstack-new-site	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Sep 11, 2024 9:11pm

[coderabbitai]

Walkthrough

The changes introduce a new section in the documentation that details the use of other model fields within field-level policies. It highlights the importance of including all relevant fields in the select query for proper evaluation of the policy. The documentation clarifies that omitting a field from the select query results in the policy evaluating to false, which prevents data retrieval. Two illustrative examples are provided to demonstrate the impact of field inclusion on query results.

Changes

Files	Change Summary
docs/the-complete-guide/part1/4-access-policy/4.7-field-level.md	Added a section on "Using other model fields within Field-Level Policies" explaining field inclusion in select queries. Included examples demonstrating the effects of field inclusion on query results.

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

• X
• Mastodon
• Reddit
• LinkedIn

Tips

Chat

There are 3 ways to chat with CodeRabbit:

‼️ IMPORTANT
Auto-reply has been disabled for this repository in the CodeRabbit settings. The CodeRabbit bot will not respond to your replies unless it is explicitly tagged.

• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai generate interesting stats about this repository and render them as a table.
  • @coderabbitai show all the console.log statements in this repository.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 0

Outside diff range and nitpick comments (1)

docs/the-complete-guide/part1/4-access-policy/4.7-field-level.md (1)

125-154: Documentation changes look good!

The new section "Using other model fields within Field-Level Policies" provides an important note about including fields used in field-level policies in the select query. The examples effectively demonstrate the impact of field inclusion on query results.

Great job on enhancing the documentation with this valuable information!

Consider adding a comma after "Otherwise" to improve readability:

-NOTE: When including other fields from a model in a field-level policy, the fields must also be included in the select query. Otherwise the field-level policy will always evaluate to false because the field is not available to the rule evaluator.
+NOTE: When including other fields from a model in a field-level policy, the fields must also be included in the select query. Otherwise, the field-level policy will always evaluate to false because the field is not available to the rule evaluator.

Tools

LanguageTool

[uncategorized] ~127-~127: A comma may be missing after the conjunctive/linking adverb ‘Otherwise’.
Context: ...t also be included in the select query. Otherwise the field-level policy will always eval...

(SENT_START_CONJUNCTIVE_LINKING_ADVERB_COMMA)

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 8a0b92a and ff5d1cb.

Files selected for processing (1)

• docs/the-complete-guide/part1/4-access-policy/4.7-field-level.md (1 hunks)

Additional context used

LanguageTool

docs/the-complete-guide/part1/4-access-policy/4.7-field-level.md

[uncategorized] ~127-~127: A comma may be missing after the conjunctive/linking adverb ‘Otherwise’.
Context: ...t also be included in the select query. Otherwise the field-level policy will always eval...

(SENT_START_CONJUNCTIVE_LINKING_ADVERB_COMMA)

[ymc9]

Hi @heyweswu , thanks for making this PR. Actually the fields referenced in the field-level rules are supposed to be automatically included. Let me check if it's actually a bug.

[heyweswu]

Hi @heyweswu , thanks for making this PR. Actually the fields referenced in the field-level rules are supposed to be automatically included. Let me check if it's actually a bug.

@ymc9 Sounds good thank you for checking. Let me know if I can help! I dug down into some generated code and found a guard function looking like this:

function User$lastName_read(input, context) {
    return (((input === null || input === void 0 ? void 0 : input.organizationId) == 'organization123'));

input if I followed correctly was being passed entity from checkReadField. And entity was always only the specific fields in a given select of a query.

For example in the below query:

db.user.findMany({
  select: {
    lastName: true
  }
})

entity would come back as:

{
  lastName: 'Smith'
}

[heyweswu]

@ymc9 another detail/question we ran into today: If we have both model level and field level policies is there a way to fall back onto the model level policy if the field level policy evaluates to false (override set to true)? Or is it that if we set override to true we need to provide all the policy logic to allow read within the field-level allow?

[ymc9]

@ymc9 another detail/question we ran into today: If we have both model level and field level policies is there a way to fall back onto the model level policy if the field level policy evaluates to false (override set to true)? Or is it that if we set override to true we need to provide all the policy logic to allow read within the field-level allow?

Hi @heyweswu , the "override" parameter allows a field to be accessed even if the entire entity cannot be accessed. It's explained in more details here: https://zenstack.dev/docs/the-complete-guide/part1/access-policy/field-level#overriding-model-level-policies There isn't a way to fall back from field-level to model-level yet. You can consider creating a github feature request for it.

[ymc9]

Hi @heyweswu , thanks for making this PR. Actually the fields referenced in the field-level rules are supposed to be automatically included. Let me check if it's actually a bug.

@ymc9 Sounds good thank you for checking. Let me know if I can help! I dug down into some generated code and found a guard function looking like this:

function User$lastName_read(input, context) {
    return (((input === null || input === void 0 ? void 0 : input.organizationId) == 'organization123'));

input if I followed correctly was being passed entity from checkReadField. And entity was always only the specific fields in a given select of a query.

For example in the below query:

db.user.findMany({
  select: {
    lastName: true
  }
})

entity would come back as:

{
  lastName: 'Smith'
}

Hey @heyweswu , back to the original problem, I couldn't seem to reproduce the issue with a simple project. Do you have a sharable repro project? Thanks!