Filters of @authorization directive are not taken into account for top-level aggregate queries

[andreloeffelmann]

Describe the bug
When invoking a top-level aggregate query the @authorization filter directive is not taken into account.
Instead, the count of all existing data is returned.

Type definitions

type Product @authorization(filter: [{requireAuthentication: false, operations: [READ], where: {AND: [{node:{isPublic:true}}] }}]) {
  name: String
  isPublic: Boolean!
}

To Reproduce
Steps to reproduce the behavior:

1. Execute the following Mutation:

mutation {
  createProducts(input: [{ name: "1" isPublic:true }{ name: "2" isPublic:false }]) {
    info {
      nodesCreated
    }
  }
}

2. Then run the following Query:

query {
  productsAggregate{
    count
  }
}

3. A count of 2 instead of 1 is returned.

Expected behavior
It seems that the filter of the @authorization directive is not taken into account for the aggregate query. The query should return a count value of 1 instead of 2.

System (please complete the following information):

• Version: @neo4j/graphql@5.1.0

[neo4j-team-graphql]

Many thanks for raising this bug report @andreloeffelmann. 🐛 We will now attempt to reproduce the bug based on the steps you have provided.

Please ensure that you've provided the necessary information for a minimal reproduction, including but not limited to:

• Type definitions
• Resolvers
• Query and/or Mutation (or multiple) needed to reproduce

If you have a support agreement with Neo4j, please link this GitHub issue to a new or existing Zendesk ticket.

Thanks again! 🙏

[mjfwebb]

Hi @andreloeffelmann, please use the AGGREGATE operation instead of READ inside your @authorization arguments:

    type Product
        @authorization(
            filter: [
                {
                    requireAuthentication: false
                    operations: [AGGREGATE]
                    where: { AND: [{ node: { isPublic: true } }] }
                }
            ]
        ) {
        name: String
        isPublic: Boolean!
    }

Edit:

Also worth noting AGGREGATE can be added to the list of operations, instead of being the only entry:

    type Product
        @authorization(
            filter: [
                {
                    requireAuthentication: false
                    operations: [READ, AGGREGATE]
                    where: { AND: [{ node: { isPublic: true } }] }
                }
            ]
        ) {
        name: String
        isPublic: Boolean!
    }

[andreloeffelmann]

Hi @mjfwebb, thanks for the quick reply!
I can confirm that this works :)
Unfortunately I found nothing about the several options for operations in the docs here. That's why I was not aware of this option and raised this bug.
Is this documented somewhere else? What other options are allowed for the operations field?

[mjfwebb]

Oh, I'm sorry about that! I'll ensure the documentation is updated ASAP. As you say, it is missing.

The options available for the operations field for the directives are as follows:

Authentication directive

READ
AGGREGATE
CREATE
UPDATE
DELETE
CREATE_RELATIONSHIP
DELETE_RELATIONSHIP
SUBSCRIBE

Authorization directive

filter:

READ
AGGREGATE
UPDATE
DELETE
CREATE_RELATIONSHIP
DELETE_RELATIONSHIP

validate:

READ
AGGREGATE
CREATE
UPDATE
DELETE
CREATE_RELATIONSHIP
DELETE_RELATIONSHIP

[andreloeffelmann]

Oh wow, that's a lot more supported functionality than I was aware of :)
Thanks for the clarification!
This can be closed.