New: Add queryHook for role-agnostic query filtering - #106
Merged
Conversation
accessQueryHook is skipped for super users (access filtering), which silently breaks user-driven list filters that must apply to every role. queryHook runs in queryHandler for all users, after requestHook and before pagination, so filter clauses merge into req.apiData.query without affecting counts or the Link header.
|
🎉 This PR is included in version 3.9.0 🎉 The release is available on: Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New
queryHook, a mutable hook invoked inqueryHandlerfor every user (afterrequestHook, before pagination), letting observers merge user-driven filter clauses intoreq.apiData.query.This complements
accessQueryHook(#103), which is deliberately skipped for super users so they see unfiltered results. That bypass is correct for access filtering ("what may this user see") but silently breaks user-driven list filters ("what did this user ask to see") — e.g. projects-dashboard filters sourced from another collection — which must apply regardless of role. Such filters previously had no role-agnostic seam to attach to;queryHookis that seam. Running before pagination keeps counts and theLinkheader accurate.Testing
queryHookfrom a module and merge a clause intoreq.apiData.query.queryendpoint and confirm the clause is applied (whereas anaccessQueryHookclause is not).