Access policy violation on insert

[divan]

I'm trying to add one entity that has access policy based on computed field. It works fine for select, but upon insert I get "access policy violation" error.

Here is a minimal reproducable example.

default.esdl

module default {
	global current_club -> uuid;

	type Member {
		property `name` -> str;
  		link club := .<members[IS Club];

		# club owner can see only own club members
	  	access policy club_owner_has_access_to_own
    			allow all
		    	using (global current_club ?= .club.id);
	};

	type Club {
		property `name` -> str;
  		multi link `members` -> Member {
		    	constraint exclusive;
  		}
	};
}

Queries to reproduce:
demo.edgeql

INSERT User { name := <str>"not-superadmin" }
INSERT Club { name := <str>"my-club" }

# set current club for the user query (i.e. owner of the club makes the query)
set global current_club := (SELECT Club.id LIMIT 1);

# attempt to add a new member to club user owns
WITH Club := (SELECT Club FILTER .name = <str>"my-club" LIMIT 1)
UPDATE Club SET {
  members += (
    INSERT Member {
      name := <str>"new-member",
    }
  )
}

Returns:

edgedb query -f demo.edgeql
OK: SET GLOBAL
edgedb error: AccessPolicyError: access policy violation on insert of default::Member

Could someone explain why the access policy is violated here?
What would be the proper way to add member to the club in this example?

[divan]

I'm guessing it can't insert new Member, because club is computed before new member is added to the Club.

I managed to solve this by adding another policy which explicitly allows inserting when club is empty:

  	access policy club_owner_can_insert_new
    	      allow insert
    	      using (not exists .club)

But that doesn't look to me like an idiomatic solution or proper usage of access policies. Any advice?

[raddevon]

I think you're right about why this doesn't work. What if you put the link on Member and used a backlink on Club? I think that might make for better ergonomics around what you're trying to do.

[divan]

Yes, this way it works (used it with other type this way).

That's actually one of the topics where I'm struggling from time to time in EdgeDB – if you can express relationships in two different ways, which one to choose? Both ways kinda equal, but not really, and this "not really" part is not obvious (like in this example).