CODEWITHSUNDEEP
keystonejs
Sid Ali
Sid Ali

Reputation: 1857

Keystone.js 6 access denied adminMeta

i want to seed data onConnect, but i have access denied, using this query :


{
        keystone: keystone {
        adminMeta {
          lists {
            key
            description
            label
            singular
            plural
            path
            fields {
              path
            }
          }
        }
      }

i have this error even iam using sudo, context.sudo().graphql.raw :


[
  Error: Access denied
      at /Users/sidalitemkit/work/web/yet/wirxe/wirxe-app/node_modules/@keystone-next/admin-ui/system/dist/admin-ui.cjs.dev.js:552:19
      at processTicksAndRejections (node:internal/process/task_queues:94:5)
      at async Promise.all (index 0)
      at async Promise.all (index 0) {
    locations: [ [Object] ],
    path: [ 'keystone', 'adminMeta' ]
  }
]

here my config :

export default auth.withAuth(
  config({
    db: {
      adapter: 'prisma_postgresql',
      url:
        'postgres://admin:aj093bf7l6jdx5hm@wirxe-app-database-do-user-9126376-0.b.db.ondigitalocean.com:25061/wirxepool?schema=public&pgbouncer=true&sslmode=require',
      onConnect: initialiseData,
    },
    ui: {
      isAccessAllowed: (context) => !!context.session?.data,
    },
    lists,
    session: withItemData(
      statelessSessions({
        maxAge: sessionMaxAge,
        secret: sessionSecret,
      }),
      { User: 'email' },
    ),
  }),
);

i figured out that when i do :

isAccessAllowed: (context) => true

it's working

any advice here

Upvotes: 1

Views: 1165

Answers (2)

AngelMS
AngelMS

Reputation: 61

You can find a working example in keystonejs repository (blog)

You have to await and pass context to the initialiseData() method. The onConnect hook already provides this context for you

also, you can look for an argument like '--seed-data' so it's only run once and run the code as:

keystone --seed-data

export default auth.withAuth(
  config({
    db: {
      adapter: 'prisma_postgresql',
      url:
        'postgres://admin:aj093bf7l6jdx5hm@wirxe-app-database-do-user-9126376-0.b.db.ondigitalocean.com:25061/wirxepool?schema=public&pgbouncer=true&sslmode=require',
      async onConnect(context) {
        if (process.argv.includes('--seed-data')) {
          await initialiseData(context);
        }
      },
    },
    ui: {
      isAccessAllowed: (context) => !!context.session?.data,
    },
    lists,
    session: withItemData(
      statelessSessions({
        maxAge: sessionMaxAge,
        secret: sessionSecret,
      }),
      { User: 'email' },
    ),
  }),
);

Upvotes: 0

Gautam Singh
Gautam Singh

Reputation: 1138

context.sudo() disabled access control. there could be some issue with your query. isAccessAllowed: (context) => true is related to admin-ui and not to the backend implementation of graphql. This could be a bug please open a bug in the repo. They whould be able to fix it quickly.

I do not see sample initialiseData to try myself. Also the graphql is designed as such if you try to access some non existing item then it may give you access denied error even though there is not access control (all access set to true).

There is also another api which is easier in creating the initial items. You should use new list api, available as context.sudo().lists.<ListName>.createOne or createMany like this

const user = await context.sudo().lists.User.createOne({
  data: {
    name: 'Alice',
    posts: { create: [{ title: 'My first post' }] },
  },
  query: 'id name posts { id title }',
});

or

const users = await context.lists.User.createOne({
  data: [
    {
      data: {
        name: 'Alice',
        posts: [{ create: { title: 'Alices first post' } }],
      },
    },
    {
      data: {
        name: 'Bob',
        posts: [{ create: { title: 'Bobs first post' } }],
      },
    },
  ],
  query: 'id name posts { id title }',
});

for more details see List Items API and Database Items API in their preview documentation.

Upvotes: 2

Related Questions