What means "unknown field: NotFoundOrDenied"?

[iBobik]

Hi, my users face hard to reproduce error (only sometimes happens):

Request:

{
  "query": "\n    mutation createOffer($data: OfferCreateInput!) {\n  result: createOffer(data: $data) {\n    ok\n    errorMessage\n    node {\n      ...Offer\n    }\n  }\n}\n    \n    fragment Offer on Offer {\n  id\n  product {\n    id\n    title\n    imageUrl\n  }\n  price\n  quantity\n  size {\n    id\n    title\n  }\n  dueDate\n}\n    ",
  "variables": {
    "data": {
      "dueDate": "2023-12-27T22:19:41.558Z",
      "price": 52222,
      "quantity": 1,
      "product": { "connect": { "id": "f0f0677c-1f93-44a3-8243-512c82d217b2" } },
      "size": { "connect": { "id": "eb436971-086d-4474-ad22-de554a000dcd" } },
      "merchant":  { "connect": { "id": "8ea7a888-fc85-4886-a12e-518c2d040f98" } }
    }
  },
  "operationName": "createOffer"
}

Response:

{
  "ok": false,
  "errorMessage": "Execution has failed:\nunknown field: NotFoundOrDenied ()",
  "node": null
}

I can privately share HAR with failed requests.

[matej21]

Hi, this is probably caused by insufficient permissions. could you please share ACL definition for the Offer entity?

[iBobik]

It is currently defined like this:

@acl.allow(merchantRole, {
  when: { merchant: acl.canRead('offers') },
  read: true,
})
@acl.allow(merchantRole, {
  when: { merchant: acl.canUpdate('offers') },
  create: true,
  update: true,
  delete: true,
})
export class Offer {

This have not changed lately and worked yesterday.

But I changed Merchant part (which must have broke it):

 @acl.allow(merchantRole, {
   when: { personId },
-  create: true,
+  create: ['name', 'addressStreet', 'addressCity', 'addressPostCode', 'addressCountry', 'taxNo', 'phone', 'payoutBankAccount'],
   read: true,
-  update: true,
+  update: ['name', 'addressStreet', 'addressCity', 'addressPostCode', 'addressCountry', 'taxNo', 'phone', 'payoutBankAccount'],
 })
 export class Merchant {
 	personId = def.uuidColumn().notNull()
+  active = def.boolColumn().notNull().default(false)
 	name = def.stringColumn().notNull().default('')
   addressStreet = def.stringColumn().notNull().default('')
   addressCity = def.stringColumn().notNull().default('')

[matej21]

Yes, that is the issue, you are missing an "offers" field in the array of allowed fields. And since you are referencing the field in { merchant: acl.canUpdate('offers') },, it is evaluated "not allowed".

[iBobik]

@matej21 I've added 'offers' to the update, created and executed migration, restarted, but result is the same.

[iBobik]

Also switch to update: true, on the Merchant did not helped.

But helped removing when: { merchant: acl.canUpdate('offer') }, from the Offer.

[iBobik]

So I replaced all acl.canUpdate('offer') by when: { merchant: { personId } },, I can live without it.

[iBobik]

Btw, it would be nice to offer some better permissions debug in the response (next to the SQL queries). I like this tool in Drupal (Devel Node Access): https://www.drupal.org/files/issues/Picture%201_0_151.png