For clarification, when Dgraph generates the queries and mutations based on a schema, it generates a queryType and a getType for each type.
When using the @auth directive, I only see the query rule and no example rules for get. As get is a query, I am assuming that the query rules protects queryType and getType queries with a single rule.
I am just wanting to clarify that someone cannot use getType with an id that bypasses the query rule.
If this is the case, I do not mind making a pull request to clarify this in the docs.
If I don’t get a good answer, I will just test it and report back. Got to switch versions of Dgraph I am using first though.
On a side note, when running :latest I see that I am on 20.03.3 and the docs show they are for versions: Master or 20.03.1. Is there a way to clarify that the same docs also apply to 20.03.3 if nothing in the docs needed to change for that version? Maybe applying docs to major versions like 20.03 and then having in doc notes where minor versions may differ such as 20.03.1 vs. 20.03.3. I know we can always go read the CHANGELOG, but this would be helpful for new members who may think that master is 20.03.3 but it is actually 20.07.0-beta.Jun22+
Also the latest version is wrongly stated on https://dgraph.io/docs/master/deploy/