One to many relation and cross permissions

Questions and Answers
1

Hello,

I have two collections, workshops and registereds. A relation field has been added to the workshop collection: a workshop belongs to registereds.

Now, permission are: workshops can be found publicly, but not the registereds. The registereds endpoint correctly shows the forbiden message, but registereds appear through the workshops endpoint, which I don’t want to since there are email information. And since this is not allowed I am wondering why they are shown.

How can I prevent the registereds to be listed at the workshops endpoint?

Thanks,
Nicolas

2

Within your ./api/workshop/models/workshop.settings.json file you can set the autoPopulate option to false under the relation field.

3

Thanks, it works perfectly. Now, would it be possible to get the relation field when having the proper permissions?

4

Not currently no, that’s something that would require a custom controller to handle (checking the ctx.state.user and sending a different populate array to the service.)

5

Ok, that would have reduced the number of queries when admin, but not as important as having emails in clear.

I guess that the graphQL plugin will have the same behavior?