What is the alternative for item-level access control for query operations ?

[NadimD]

Greetings,
I set up a forum system with roles and I need to add access control so that some forums can be publicly seen and some not, but the docs say this :

Item-level access control is not available for query operations. Keystone has opted to disable read access control for query operations as applying after queries will reuslt in inconsistent pagination behaviour and mismatched count results.

It seems I'm blocked here because I can't get the item for testing it against my roles and permissions.

Can you please point me in the right direction ?
Do I need to set up custom routes that do the filtering ? That seems redundant but I can't think of another solution.

Thank you !

EDIT :
Example : In the query access control, I read the user's roles in the session but I can't currently access the item "forum" that is being called in order to see if it has permissions and roles attached to it.

[dcousens]

Why can't you use access.filter.query?

[NadimD]

The issue is that in access.filter.query there is no way to get the actual ids that are fetched and I need them in order to run some queries before returning a boolean. Maybe this scenario doesn't fit with filters, in which case can you tell me if I should make a GQL resolver just for this case please ?

[dcousens]

We could probably add access.item.read to be honest, I think the pagination problems might be less important to some and could maybe be disabled.

As is, the underlying code is not written for this kind of feature addition; I don't have any other recommendations for you other than to try and use access.filter.query.

[borisno2]

Example : In the query access control, I read the user's roles in the session but I can't currently access the item "forum" that is being called in order to see if it has permissions and roles attached to it.

You should be able to use access.filter.query to filter the "forum" list being called. So instead of checking a value on the item and returning true or false you can filter for that value. As an example in my project I am filtering the enrolments a user can read based on a session id - https://github.com/borisno2/on-the-hill-drama-club/blob/main/src/keystone/helpers.ts#L49 - I have handled fairly complex access requirements with filter I would be interested in seeing an example where it didn't work.

[NadimD]

Thank you both for your answers, it let me rethink my permission system and I am finally able to use the filter as such :

return {
  canSeeForum: {
    some: {
      id: {
        in: groupIds,
      },
    },
  },
};

In "canSeeForums", I store an array of groups, and I retrieve groupIds from the session which contains groups related to a user if connected. If not connected, I give the guest users the group "guest".

Now to explain why at first my permission system didn't work with filter, it's because I didn't use relationships correctly and I stored ids as plain JSON, which I couldn't retrieve in the filter. This let me make dynamic schemas but in the end I got stuck with a logic that doesn't fit well with Keystone and I reverted to using relationships and now everything is good !

Sorry if I wasted your time, I couldn't get around this issue and now that you sent me a link to your source code, I'm confident and I went with a similar way.

Here is a screenshot (in french) of how permissions are now handled by relationships to groups :

[dcousens]

@NadimD did you happen to see our usecase-roles example? https://github.com/keystonejs/keystone/blob/main/examples/usecase-roles/access.ts

[NadimD]

Thank you very much, I didn't know there were more examples than the ones in the docs. It's a gold mine !