Enhancement of documentation for use of privacy callback

[jwittekind]

Could you please add some more information about how to use the 'privacy' callback on GraphQL Types?

It seems that e.g. calling the getSelectFields() Method is required for the privacy configuration in a GraphQL Type to take effect.
This isn't mentioned in the appropriate section of the documentation and currently i even notice that this does not even work when i call the getSelectFields() method in my query. This can lead to dangerous data leaks and should be well documented.

Thanks in advance!
Greets,
Jules

[mfn]

Thanks for the info!

I'd say PRs are welcome (I think we've tests for this…)

[jwittekind]

Sry, for asking again. Last year i already opened an issue of how to use the privacy field, but to me it seems like i found a bug here.

I know that privacy does only work with SelectFields, but it does not seem to work with nested Types and arrays.
Actually my privacy callback does not even get called.

Could you take a look at my example repository?
https://github.com/jwjuele/rebing-graphql-privacy-test

I tried to place some comments in the code. Please checkout the app/Graphql/TestQuery.php

[mfn]

I could be wrong, but I think the issue is that in \App\GraphQL\Type\ParentType::fields for children you use 'selectable' => false,.

This any further processing of children is not done by SelectFields at all and as a consequence, since 'privcacy' is a feature only provided through SelectFields, it does not work.

In the end, 'privcacy' is just sugar and is executed before your resolver is included. In the absence of assistance of SelectFields, just include the respective logic directly in your resolver.

[jwittekind]

Is there any reason why the privacy field should only work when the according field is a database field?
I could imagine, that a use case as described above is valid.

[mfn]

Is there any reason

I guess the simplest answer is: "because reasons" as it was only implemented in SelectFields, which however is optional or not available in some cases like this one 🤷‍♀️

I guess I see your argument, that it could be part of the "generic" code unrelated to SelectFields.

[ricardosierra]

I need to implement privacy on arrays that are not columns in a database. Is there any way to do this?