Generate directive doesn't disable upsert on add

Issues GraphQL
1

When setting a graphql schema with the generate directive with enabled add mutation and disabled update and delete mutations it’s possible to update via the addX(input: { ...X }, upsert: true) mutation.

I’d expect that with updates and deletions disabled that upserting is not available.

Sample requests:

POST /admin/schema

type Foo @generate(
  query: {
    get: true,
    query: true,
    password: false,
    aggregate: false
  },
  mutation: {
    add: true,
    update: false,
    delete: false
  },
  subscription: false,
) {
  x: String! @id @search(by: [exact])
  y: String!
}

Then populate the type with a value

POST /graphql
mutation {
  addFoo(input: [
    { x: "a", y: "a" }
  ]) { foo { x y } }
}

Attempting to add to the same ID fails as expected with:

couldn’t rewrite mutation addFoo because failed to rewrite mutation payload because id a already exists for field x inside type Foo

mutation {
  addFoo(input: [
    { x: "a", y: "b" }
  ]) { foo { x y } }
}

Upsert onto the same ID succeeds with upsert: true

POST /graphql
mutation {
  addFoo(input: [
    { x: "a", y: "b" }
  ], upsert: true) { foo { x y } }
}

ETA:
After disabling upsert via Ratle on Foo.x it’s still possible to upsert via GraphQL for the same Foo.x

1 Like
2

@minhaj can maybe look at this as a feature request.

But thinking about this more, you should be able to prevent the upsert/update if you add a RBAC auth rule on update that always equates to false you will prevent the upsert.