CardinalityViolationError: required link ... is hidden by access policy

[divan]

Hi, I'm stuck with required link is hidden by access policy error and not sure how to properly fix this situation.

Here is a minimal example:

module default {
	global current_user_id -> uuid;
	global current_user := (SELECT User FILTER .id = global current_user_id);

	# user/person
	type User {
		required property name -> str  {
			constraint exclusive;
		};
	}

	# competitor record for the person
	type Competitor {
		link user -> User;

		# user can see only own competitor
		access policy denied_all
		  allow all
		  using (false);

		access policy user_see_own_competitor
			allow all
			using (GLOBAL current_user ?= .user);
	}

	# particular event participation record
	type Participant {
		required link `competitor` -> Competitor;
		required property `event` -> str;
	}
}

Insert some test data (with access policies disabled):

INSERT User { name := <str>'test' };
{default::User {id: 674acc38-e5d3-11ed-993d-b7f1fa7be651}}
INSERT User { name := <str>'test2' };

INSERT Competitor { user := (SELECT User Limit 1) };
INSERT Competitor { user := (SELECT User Offset 1 Limit 1) };

INSERT Participant { competitor := (SELECT Competitor LIMIT 1), event := <str>'test' };
INSERT Participant { competitor := (SELECT Competitor Offset 1 LIMIT 1), event := <str>'test' };

Access policy is intendend to show only "own" participants to the user.

Now, assuming current user is the first one, I expect to see only participants with users' competitor. Instead, it returns an error:

SET GLOBAL current_user := <uuid>'674acc38-e5d3-11ed-993d-b7f1fa7be651';
SELECT Participant {id,competitor: { user: {name}}}
edgedb error: CardinalityViolationError: required link 'competitor' of object type 'default::Participant' is hidden by access policy

I understand the logic behind the error – .competitor is required, so it should not be empty. But at the same time, I don't care about participants which I don't have access to.

How can I rewrite query of access policy to make it behave this way instead of failing with an error?

[elprans]

I don't care about participants which I don't have access to.
How can I rewrite query of access policy to make it behave this way instead of failing with an error?

You should add an access policy to Participant object also. Access policies are not automatically transitive, i.e. they wouldn't translate to a pointing object type simply because a link is required. So

type Participant {
    required link `competitor` -> Competitor;
    required property `event` -> str;
    
    access policy user_see_own_competitor
        allow all
        using (GLOBAL current_user ?= .competitor.user);
}

Also, you don't need to explicitly add denied_all policies as they're implied for all types that have access policies on them.

[divan]

You should add an access policy to Participant object also.

Oh, okay, thank you. I think I tried that too and got the same error, but let me try again.

Also, you don't need to explicitly add denied_all

Right, thank you. I was cleaning up some other access policies not relevant to the reproducible example and just added it for clarity in the post.