[question] Authorization/Queryset filtering

[cocochepeau]

First of all, thanks for the amazing work!

By using this: http://docs.graphene-python.org/projects/django/en/latest/authorization/#queryset-filtering-on-lists
How can I achieve the same thing with relay queries. For example with:

class ProjectNode(DjangoObjectType):
    class Meta:
        model = Project
        interfaces = (relay.Node, )


class ProjectFilter(django_filters.FilterSet):
    class Meta:
        model = Project
        fields = [
            'id', 'published',
        ]


class Query(object):
    project = relay.Node.Field(ProjectNode)
    projects = DjangoFilterConnectionField(
        ProjectNode,
        filterset_class=ProjectFilter
    )

    def resolve_projects(self, args, info): # It does not work
        return Project.objects.filter(published=True)

Basically, I want to limit the queryset to only published projects.

Thanks again.

[zbyte64]

I don't currently see a good way to do this, the querysets are merged during DjangoConnectionField.resolve_connection which grabs the default_queryset from the model's manager. I've had to extend my own DjangoFilterConnectionField to perform authorization checks. #79 purposes that the object nodes support a get_queryset method which would make this allot easier.

[cocochepeau]

Thanks for your answer. I'm still learning Python/Django so thanks again for the explanation. :)
The idea would be to let us decide directly on the get_queryset method, like in https://docs.djangoproject.com/en/2.1/topics/db/managers/#modifying-a-manager-s-initial-queryset?

I'll try to follow #79 as well.

[zbyte64]

You would now define a ProjetNode.get_queryset to filter by user globally.