Backrelation but use field from other relation as relField

[ValentinKolb]

I have a question regarding back relations:

I think I understand the syntax referenceCollection_via_relField.

Am I right that in the statement referenceCollection_via_relField.column the column comes from the referenceCollection?

When writing API rules, the autocomplete sometimes also suggests someCollection.referenceCollection_via_relField.someField but what does this syntax do?

Regarding my main question: I want to expand a backrelation by a relField that comes from a relation. Here is my example:

collection User {
    id: string
    group: relation -> Group
    ...
}

collection Group {
  company: relation -> Company
}

collection Company {
   adminGroup: relation -> Group
}

So basically I have a one-to-many relation from Company to Group and a one-to-many relation from Group to User, but via backreferences. Additionally, I have a relation from one Company to one Group that controls the admins.

Now, I want an API rule for the User collection, so that all users in the admin group of the company of the user can VIEW/UPDATE/... the user (that is from the same company).

Is there any way that I can do this?

I have something similar to the following snippet, but this is obviously incorrect:

@request.auth.id =? User_via_(group.company.adminGroup).id

[ganigeorgiev]

Am I right that in the statement referenceCollection_via_relField.column the column comes from the referenceCollection?

Yes. referenceCollection_via_relField represents records from referenceCollection. The _via_relField specifies what field to use to perform the "join".

When writing API rules, the autocomplete sometimes also suggests someCollection.referenceCollection_via_relField.someField but what does this syntax do?

See the previous answer.

Now, I want an API rule for the User collection, so that all users in the admin group of the company of the user can VIEW/UPDATE/... the user (that is from the same company).

I'm a bit confused and don't understand the need of both groups->company and company->groups relations. Maybe a simple "isAdmin" bool flag in the Group collection would suffice (or there are limitations of how many "admin" groups a company could have?)?

Unless I'm not reading it correctly, based on the ERD it looks like a single user can have only 1 group, which means that the user's group is either an "admin" group or not. In that case the User collection API rule could look like:

// require the user to be authenticated
@request.auth.id != "" &&
// require the authenticated company's adminGroup to match with the group of the user we want to access
@request.auth.group.company.adminGroup = group

[ValentinKolb]

Thank you for your answer!

I'm a bit confused and don't understand the need of both groups->company and company->groups relations. Maybe a simple "isAdmin" bool flag in the Group collection would suffice (or there are limitations of how many "admin" groups a company could have?)?

My actual Datamodel is a bit different but i created this example so that everything would map.

Unless I'm not reading it correctly, based on the ERD it looks like a single user can have only 1 group, which means that the user's group is either an "admin" group or not. In that case the User collection API rule could look like:

Jes ok this makes perfekt sense. Thank you.

@request.auth.group.company.adminGroup = group

Could I also write: group.company.adminGroup = group? Also a more general question: Does the equal sign= automatically compares the group id's? (so is your answer equivalent to @request.auth.group.company.adminGroup.id = group.id)

Also what would I do when I have a many-to-many relation between User and Group?

[ganigeorgiev]

Could I also write: group.company.adminGroup = group?

What would be the intention here? With the above rule you are practically checking if the group of the user you are trying to access is and admin group for its company. By using @request.auth.* you are checking against the group of the current authenticated user.

Does the equal sign= automatically compares the group id's?

In the above we are comparing directly the field values as they are stored in the db (for single relation fields that is the id of the relation record), or in other words - yes, in this case group and group.id will point to the same string value (the latter will make one extra join but this will be optimized in the future so both will result in the same query).

For multiple relation field the value is serialized json array so in this case group and group.id would mean 2 different things - ["id1", "id2"] vs "id1".

If you have further questions, please don't treat the discussions as LLM chat and try to clearly elaborate on your issue and what you are trying to do to avoid the needless back-and-forth (see XY problem).

[ValentinKolb]

Thank for the clarification!

Yes of course thank you 👍