@auth directives don't apply to nested objects when using interfaces?

[amaster507 (Anthony Master)]

@elhil

inherited auth rules

I believe you are going amiss with this logic. I am getting confused from your OP by the statement:

@elhil

If I make a post with an approved author, the @auth directive on Post works as expected if I query
as someone other than author:

@elhil

But if I access the Post through Author:

By through Author do you mean that the JWT changed or just the query with the same JWT?

---

I think this is the answer you are looking for though:

Scope of Auth Directive Query Rules

This is more for documentation for myself and my companions, but I think it can add value to others. TL;DR; Auth Directive queries are processed before applying any other rules. You can not simply check if you already have access to one item and use it to provide access to related items When writing @auth directives I have tended to think on basis of queries to what the user can already see (as far as deep data). This was actually a flawed concept. Consider the following schema: type Conta…

---

@MichelDiz

do you know if we support Auth in custom queries?

Not right now in custom queries but there is this RFC in progress:

WIP: Auth rules custom DQL query

Motivation Support for @auth rules with @custom DQL query. User Impact Users will now be able to use @auth rules provided in the Graphql schema with @custom DQL queries also. This will be a major feature in the @custom DQL and will enhance the user experience. Implementation Overview Since @auth rules are defined in the GraphQL schema along with the type definition, we need to apply them to the DQL query based on the type queried in the DQL query. The problem reduces to finding the type of the…