@auth directives don't apply to nested objects when using interfaces?

[elhil]

I think my example was too complicated.

In short, if I have an @auth rule that forbids me access to Post, it works. But if I then query Author.posts, I can access the post. I would assume that each level of a nested query would need to respect auth rules, else we just can’t nest objects that have auth rules…

@amaster507

I think this is the answer you are looking for though:

This is more for documentation for myself and my companions, but I think it can add value to others. TL;DR; Auth Directive queries are processed before applying any other rules. You can not simply check if you already have access to one item and use it to provide access to related items When writing @auth directives I have tended to think on basis of queries to what the user can already see (as far as deep data). This was actually a flawed concept. Consider the following schema: type Conta…

I can’t tell what the outcome of this thread was. Either way, I think in the thread you’re asking “How can I make it so I only see A if nested object B also exists / is authorized”, and I’m asking “Why does access to A implicitly grant access to nested object B”.