# Cascade producing wrong resutls when auth prevents children
**URL:** https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586
**Category:** GraphQL
**Tags:** auth, area:querylang:casca, ticket:created, status:accepted
**Created:** [August 20, 2020, 3:36pm UTC](https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586 "2020-08-20T15:36:28Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@amaster507](https://discuss.dgraph.io/u/amaster507)
#### Post date: [August 20, 2020, 3:36pm UTC](https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586/1 "2020-08-20T15:36:28Z")
I am not gonna post the full working example of this bug for sake of time, but this should get the picture across.
I have a type Contact that has an edge tags to the type Tag. I have restricted tags so that if a JWT is not privided at all with a valid user, no tags are visible. There are some other rules on Tag as well to control group accessed tags. Looking at this query:
```auto
query {
queryContact @cascade {
id
tags {
id
access {
id
grants {
isGroup {
slug
}
}
}
}
}
}
```
This should only get the tags that are in a group access control list (custom defined/managed by auth rules). When I run this with a JWT that has access to tags, it provides the correct empty results when no contacts are present that are tagged with group tags.
However, if I remove the JWT, then I get wrong results that cascade should filter out.
```auto
{
"data": {
"queryContact": [
{
"id": "0x285d"
"tags": []
},
{
"id": "0x285e"
"tags": []
},
...
]
}
}
```
Those results should not be returned because they do not obey the cascade directive because they did not return any tags.
---
### Author:  [@arijit](https://discuss.dgraph.io/u/arijit)
#### Post date: [August 25, 2020, 7:28am UTC](https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586/3 "2020-08-25T07:28:56Z")
@amaster507 Can you post the schema and auth rules for the Type `Contact`, `Tag`, `Access`, `Grant` and `isGroup`? It will help me to better understand and repro the issue and I can quickly get back to you with a solution/fix.
---
### Author:  [@amaster507](https://discuss.dgraph.io/u/amaster507)
#### Post date: [August 28, 2020, 6:18pm UTC](https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586/4 "2020-08-28T18:18:56Z")
I ran into this again today and here is a very tiny dataset to duplicate:
```auto
type Contact {
id: ID!
name: String!
isUser: User
}
type User @auth(
query: { rule: "{$NO: {eq: \"yes\"}}" }
) {
username: String! @id
isContact: Contact! @hasInverse(field: isUser)
}
# No Need for Dgraph.Authorization as we are doing a absolute block where no JWT is accepted.
```
Here are the queries/mutations to run to test:
```auto
mutation AddData {
addContact(input: [
{name:"a"}
{name:"b",isUser:{username:"z"}}
{name:"c",isUser:{username:"y"}}
{name:"d"}
]) {
numUids
contact {
id
name
isUser {
username
}
}
}
}
mutation Reset {
deleteUser(filter:{}){numUids}
deleteContact(filter:{}){numUids}
}
query GetOnlyUsers {
queryContact @cascade {
id
isUser {
username
}
}
}
```
1. AddData mutation
2. GetOnlyUsers query
3. See result set returned not honoring @cascade
4. Reset mutation
5. Repeat as desired
**EDIT** : _Note_, this bug seems to be particular to JWT value rules. It is no longer present if the @auth rule is changed to:
```auto
@auth(
query: { rule: "query { queryUser(filter: {username:{eq:\"z\"}}) { username } }" }
)
```
---
### Author:  [@arijit](https://discuss.dgraph.io/u/arijit)
#### Post date: [August 31, 2020, 12:07pm UTC](https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586/5 "2020-08-31T12:07:45Z")
@amaster507 Thanks for reporting this issue. We seem to be removing fields from query when the auth variables is either absent or if the `RBAC` is evaluated to false and this is causing the cascade to fail. The above issue only occurs when we have `@cascade` with auth in the following two cases.
1. RBAC is evaluated to false.
2. Auth variables is missing.
This is how the query is being rewrittern which is incorrect.
```auto
query {
queryContact(func: uid(ContactRoot)) @cascade {
id : uid
}
ContactRoot as var(func: uid(Contact2))
Contact2 as var(func: type(Contact))
}
```
I have opened an issues and will be looking at it in the coming week. I will update you once we have a fix.
---
### Author:  [@arijit](https://discuss.dgraph.io/u/arijit)
#### Post date: [September 17, 2020, 1:48am UTC](https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586/10 "2020-09-17T01:48:52Z")
This issue is fixed in master.
>
>
> Fixes GRAPHQL-656
>
> Query:
> \`\`\`
> query {
> queryContact @cascade {
> … id
> nickName
> adminTasks {
> id
> name
> occurrences {
> due
> comp
> }
> }
> }
> }
> \`\`\`
> If \`adminTasks\` has RBAC rules which are evaluated to \`false\` the query will be rewritten as follows.
> \`\`\`
> query {
> queryContact(func: uid(ContactRoot)) @cascade {
> id : uid
> }
> ContactRoot as var(func: uid(Contact2))
> Contact2 as var(func: type(Contact))
> }
> \`\`\`
> This has better performance but returns \`Contact\` for queries with @cascade even if they don't have children fields.
>
> After this PR the query is rewritten as follows:
> \`\`\`
> query {
> queryContact(func: uid(ContactRoot)) @cascade {
> id : uid
> nickName : Contact.nickName
> adminTasks : Contact.adminTasks @filter(uid(AdminTask6)) {
> id : uid
> name : AdminTask.name
> occurrences : AdminTask.occurrences @filter(uid(TaskOccurrence4)) {
> due : TaskOccurrence.due
> comp : TaskOccurrence.comp
> dgraph.uid : uid
> }
> }
> }
> ContactRoot as var(func: uid(Contact7))
> Contact7 as var(func: type(Contact))
> var(func: uid(ContactRoot)) {
> AdminTask1 as Contact.adminTasks
> }
> AdminTask6 as var(func: uid(AdminTask1)) @filter(uid(AdminTask5))
> var(func: uid(AdminTask1)) {
> TaskOccurrence2 as AdminTask.occurrences
> }
> TaskOccurrence4 as var(func: uid(TaskOccurrence2)) @filter(uid(TaskOccurrenceAuth3))
> TaskOccurrenceAuth3 as var(func: uid(TaskOccurrence2)) @filter(eq(TaskOccurrence.role, "ADMINISTRATOR")) @cascade
> AdminTask5 as var(func: uid())
> }
> \`\`\`
>
>
> \---
> This change is \[\
\](https://reviewable.io/reviews/dgraph-io/dgraph/6444)
>
>
>
> Docs Preview: \[\
\](https://dgraph-3800fdad4e-93905.surge.sh)
---
### Author:  [@pawan](https://discuss.dgraph.io/u/pawan)
#### Post date: [October 9, 2020, 8:18am UTC](https://discuss.dgraph.io/t/cascade-producing-wrong-resutls-when-auth-prevents-children/9586/12 "2020-10-09T08:18:57Z")