Always getting global fallback error, how to know which field caused it

Question about GraphQL Shield

Is there a way to know on which field definition shield is deciding to use global fallbackRule. When I have set it to fallbackRule: deny I am seeing it always throwing the fallbackError. I am using createCollection mutation, and I have tried setting createCollection: allow and Collection: allow too, and it doesn’t make any difference vs setting rules on all of their fields individually as I have in my permissions system. My options object (I am getting no debug info too, it’s all the way fallback):

{
    debug: true, //process.env.NODE_ENV !== "production",
    // to see errors thrown inside resolvers
    allowExternalErrors: true, // process.env.NODE_ENV !== "production",
    fallbackError: new Error(
      "You are not authorised to access these resources!"
    ),
    fallbackRule: deny // FIXME: fallback error is thrown on deny
  }

Error logged is:

{"message":"You are not authorised to access these resources!","locations":[{"line":14,"column":5}],"path":["updateCollection","collection"],"extensions":{"code":"INTERNAL_SERVER_ERROR","exception":{"stacktrace":["Error: You are not authorised to access these resources!","    at Object.<anonymous> (G:\\apollo\\prod\\apollo-server\\src\\auth\\permissions.ts:252:20)","    at
Module._compile (module.js:652:30)","    at Module.m._compile (G:\\apollo\\prod\\apollo-server\\node_modules\\ts-node\\src\\index.ts:439:23)","    at Module._extensions..js (module.js:663:10)","    at Object.require.extensions.(anonymous function) [as .ts] (G:\\apollo\\prod\\apollo-server\\node_modules\\ts-node\\src\\index.ts:442:12)","    at Module.load (module.js:565:32)","    at
tryModuleLoad (module.js:505:12)","    at Function.Module._load (module.js:497:3)","    at Module.require (module.js:596:17)","
at require (internal/module.js:11:18)","    at Object.<anonymous> (G:\\apollo\\prod\\apollo-server\\src\\makeExecutableSchema.ts:14:1)","    at Module._compile (module.js:652:30)","    at Module.m._compile (G:\\apollo\\prod\\apollo-server\\node_modules\\ts-node\\src\\index.ts:439:23)","    at Module._extensions..js (module.js:663:10)","    at Object.require.extensions.(anonymous function) [as .ts] (G:\\apollo\\prod\\apollo-server\\node_modules\\ts-node\\src\\index.ts:442:12)","    at Module.load (module.js:565:32)"]}}}

I should be reproducing this, but since my whole night is lost to this, I am assuming it’s something silly that I am doing.

• [x ] I have checked other questions and found none that matches mine.

[devautor]

@maticzav This current design definitely makes sense. I had let my mind totally slip setting permissions on these mutation responses types. So much of my time wasted not following simple rules. Thanks maticzav, strucking out genius title against myself 😦

I will try this and let this thread know!

[maticzav]

Hey @devautor 👋,

Thanks for the reproduction. I believe you are experiencing the problem because createCustomerCartItem returns CreateCustomerCartItemMutationResponse which is, as defined by fallbackRule, denied by default.

There’s an open issue about the auto-guessed types and their rules, but as mentioned there, it is not possible to have a system which would meaningfully guess the provisions of the return types because a particular type can be returned by multiple fields with different restraints.