# Trying to set a simple authorization rule but \`filter\` can't handle it
**URL:** https://discuss.dgraph.io/t/trying-to-set-a-simple-authorization-rule-but-filter-cant-handle-it/16797
**Category:** Dgraph Cloud
**Tags:** kind:question, auth, dgraph
**Created:** [February 7, 2022, 7:36pm UTC](https://discuss.dgraph.io/t/trying-to-set-a-simple-authorization-rule-but-filter-cant-handle-it/16797 "2022-02-07T19:36:16Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@corysimmons](https://discuss.dgraph.io/u/corysimmons)
#### Post date: [February 7, 2022, 7:36pm UTC](https://discuss.dgraph.io/t/trying-to-set-a-simple-authorization-rule-but-filter-cant-handle-it/16797/1 "2022-02-07T19:36:16Z")
I’m following the Instaclone tutorial here and got to this part: [Modeling an Instagram Clone: Authentication - Dgraph Blog](https://dgraph.io/blog/post/insta-authentication/#enforcing-authorization-rules-using-jwt)
I’ve swapped out a couple names with `Todo` instead of `Comment` or something, and I’m just trying to lock down the ability to query stuff unless the `user_id` matches.
```auto
type Todo @withSubscription @auth(
query: {
rule: """
query($USER_ID: String!) {
queryTodo {
TodoBy(filter: { owner_id: { eq: $USER_ID }}) {
__typename
}
}
}
"""
}
) {
id: ID!
title: String!
description: String!
completed: Boolean!
owner_id: String
}
```
Everything looks simple enough, but when I try to Deploy that schema I get this error:
```auto
resolving updateGQLSchema failed because Type Todo: @auth:
failed to validate GraphQL rule
[reason : Cannot query field "TodoBy" on type "Todo".]
```
Which makes sense… there isn’t a “TodoBy” anywhere in the API. So I opened up the GraphQL Explorer and tried to create a query with a `filter` that would work, but `filter` doesn’t allow me to filter by _any_ of the subfields (like `owner_id`)…
What is the purpose of `filter` if you can’t filter by matching against a model’s fields?
Also, if someone could help me get a simple authorization schema working I would very much appreciate you. 🙂
---
### Author:  [@corysimmons](https://discuss.dgraph.io/u/corysimmons)
#### Post date: [February 7, 2022, 7:40pm UTC](https://discuss.dgraph.io/t/trying-to-set-a-simple-authorization-rule-but-filter-cant-handle-it/16797/2 "2022-02-07T19:40:11Z")
Here’s another thing I tried based off of [these docs](https://dgraph.io/docs/graphql/authorization/directive/#authorization-rules):
```auto
type Todo @withSubscription @auth(
query: {
rule: """
query ($USER_ID: String) {
queryTodo(filter: {
owner_id: { # doesn't exist......???
eq: $USER_ID
}
}) {
id
}
}
"""
}
) {
id: ID!
title: String!
description: String!
completed: Boolean!
owner_id: String
}
```
Which gave me this error:
```auto
resolving updateGQLSchema failed because Type Todo: @auth:
failed to validate GraphQL rule
[reason : Field "owner_id" is not defined by type TodoFilter.]
```
---
### Author:  [@corysimmons](https://discuss.dgraph.io/u/corysimmons)
#### Post date: [February 7, 2022, 8:36pm UTC](https://discuss.dgraph.io/t/trying-to-set-a-simple-authorization-rule-but-filter-cant-handle-it/16797/3 "2022-02-07T20:36:03Z")
Turns out I just needed to add `@search` to the `owner_id` field like so:
```auto
type Todo @withSubscription @auth(query: { rule: "query ($USER_ID: String) { queryTodo(filter: { owner_id: { eq: $USER_ID } }) { id }}"}) {
id: ID!
title: String!
description: String!
completed: Boolean!
owner_id: String @search(by:[hash])
}
```
Thank you so much @amaster507