@contember/engine-content-api 1.0.0-rc.8 → 1.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-content-api",
-  "version": "1.0.0-rc.8",
+  "version": "1.0.1",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -10,19 +10,19 @@
     "test": "uvu dist/tests/cases/ \\.js$"
   },
   "dependencies": {
-    "@contember/database": "^1.0.0-rc.8",
-    "@contember/dic": "^1.0.0-rc.8",
-    "@contember/engine-common": "^1.0.0-rc.8",
-    "@contember/graphql-utils": "^1.0.0-rc.8",
-    "@contember/schema": "^1.0.0-rc.8",
-    "@contember/schema-utils": "^1.0.0-rc.8",
+    "@contember/database": "^1.0.1",
+    "@contember/dic": "^1.0.1",
+    "@contember/engine-common": "^1.0.1",
+    "@contember/graphql-utils": "^1.0.1",
+    "@contember/schema": "^1.0.1",
+    "@contember/schema-utils": "^1.0.1",
     "@graphql-tools/schema": "^7.1.5",
     "graphql-tag": "^2.12.5"
   },
   "devDependencies": {
-    "@contember/database-tester": "^1.0.0-rc.8",
-    "@contember/engine-api-tester": "^1.0.0-rc.8",
-    "@contember/schema-definition": "^1.0.0-rc.8",
+    "@contember/database-tester": "^1.0.1",
+    "@contember/engine-api-tester": "^1.0.1",
+    "@contember/schema-definition": "^1.0.1",
     "@graphql-codegen/cli": "^1.15.2",
     "@graphql-codegen/typescript": "^1.15.2",
     "@graphql-codegen/typescript-operations": "^1.15.2",

package/src/acl/Authorizator.ts

@@ -1,8 +1,52 @@
 import { Acl } from '@contember/schema'
 
-export interface Authorizator {
-	isAllowed(operation: Acl.Operation, entity: string): boolean
-	isAllowed(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string,): boolean
 
-	isCustomPrimaryAllowed(entity: string): boolean
+export type AuthorizationResult = 'yes' | 'no' | 'maybe'
+
+export class Authorizator {
+	constructor(private readonly permissions: Acl.Permissions) {
+	}
+
+	getEntityPermission(operation: Acl.Operation, entity: string): AuthorizationResult {
+		if (!this.permissions[entity]) {
+			return 'no'
+		}
+		const entityPermissions: Acl.EntityPermissions = this.permissions[entity]
+
+		if (operation === Acl.Operation.delete) {
+			return this.predicateToResult(entityPermissions.operations.delete)
+		}
+		const fieldPermissions = entityPermissions.operations[operation]
+		if (!fieldPermissions) {
+			return 'no'
+		}
+		return Object.values(fieldPermissions).filter(it => !!it).length > 0 ? 'yes' : 'no'
+	}
+
+	getFieldPredicate(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): Acl.Predicate {
+		return this.permissions[entity]?.operations[operation]?.[field] ?? false
+	}
+
+	getFieldPermissions(operation: Acl.Operation.create | Acl.Operation.read | Acl.Operation.update, entity: string, field: string): AuthorizationResult {
+		const fieldPermissions = this.getFieldPredicate(operation, entity, field)
+		if (!fieldPermissions) {
+			return 'no'
+		}
+		return this.predicateToResult(fieldPermissions)
+	}
+
+	private predicateToResult(predicate: Acl.Predicate | undefined): AuthorizationResult {
+		if (!predicate) {
+			return 'no'
+		}
+		if (predicate === true) {
+			return 'yes'
+		}
+		return 'maybe'
+	}
+
+
+	isCustomPrimaryAllowed(entity: string): boolean {
+		return this.permissions?.[entity]?.operations?.customPrimary || false
+	}
 }

package/src/acl/index.ts

@@ -3,6 +3,5 @@ export * from './PermissionFactory'
 export * from './PermissionsByIdentityFactory'
 export * from './PredicateFactory'
 export * from './PredicatesInjector'
-export * from './StaticAuthorizator'
 export * from './VariableInjector'
 export * from './VariableUtils'

package/src/extensions/paginatedHasMany/PaginatedHasManyFieldProviderVisitor.ts

@@ -3,6 +3,7 @@ import { FieldMap } from '../EntityFieldsProvider'
 import { PaginatedHasManyFieldProviderExtension } from './PaginatedHasManyFieldProvider'
 import { capitalizeFirstLetter } from '../../utils'
 import { PaginatedFieldConfigFactory } from '../../schema/PaginatedFieldConfigFactory'
+import { aliasAwareResolver } from '../../schema'
 
 export class PaginatedHasManyFieldProviderVisitor implements
 	Model.ColumnVisitor<FieldMap<PaginatedHasManyFieldProviderExtension>>,
@@ -47,6 +48,7 @@ export class PaginatedHasManyFieldProviderVisitor implements
 				extensions: {
 					relationName: relation.name,
 				},
+				resolve: aliasAwareResolver,
 			},
 		}
 	}

package/src/introspection/IntrospectionSchemaFactory.ts

@@ -107,7 +107,7 @@ export class IntrospectionSchemaFactory {
 			},
 		})
 		return Object.values(getEntity(this.model, entityName).fields)
-			.filter(it => this.authorizator.isAllowed(Acl.Operation.read, entityName, it.name))
+			.filter(it => this.authorizator.getFieldPermissions(Acl.Operation.read, entityName, it.name) !== 'no')
 			.map((it): ContentSchema._Column | ContentSchema._Relation => ({
 				...additionalInfo[it.name],
 				name: it.name,
@@ -154,7 +154,7 @@ export class IntrospectionSchemaFactory {
 
 	public create(): ContentSchema._Schema {
 		const entities = Object.values(this.model.entities)
-			.filter(it => this.authorizator.isAllowed(Acl.Operation.read, it.name))
+			.filter(it => this.authorizator.getEntityPermission(Acl.Operation.read, it.name) !== 'no')
 			.map(entity => ({
 				name: entity.name,
 				customPrimaryAllowed: this.authorizator.isCustomPrimaryAllowed(entity.name),

package/src/mapper/Mapper.ts

@@ -120,11 +120,8 @@ export class Mapper {
 		const selector = this.selectBuilderFactory.create(augmentedBuilder, hydrator)
 		const filterWithPredicates = this.predicatesInjector.inject(entity, inputWithOrder.args.filter || {})
 		const inputWithPredicates = inputWithOrder.withArg('filter', filterWithPredicates)
-		const selectPromise = selector.select(this, entity, inputWithPredicates, path, groupBy)
-		const rows = await selector.execute(this.db)
-		await selectPromise
-
-		return rows
+		selector.select(this, entity, inputWithPredicates, path, groupBy)
+		return await selector.execute(this.db)
 	}
 
 	public async count(entity: Model.Entity, filter: Input.OptionalWhere) {

package/src/mapper/select/OrderByBuilder.ts

@@ -30,7 +30,7 @@ export class OrderByBuilder {
 	): [SelectBuilder<SelectBuilder.Result>, Orderable] {
 		const entries = Object.entries(orderBy)
 		if (entries.length !== 1) {
-			const fields = entries.join(', ')
+			const fields = entries.map(it => it[0]).join(', ')
 			throw new UserError('Order by: only one field is expected in each item of order by clause, got: ' + fields)
 		}
 		if (orderBy._random || orderBy._randomSeeded) {

package/src/mapper/select/SelectBuilder.ts

@@ -43,14 +43,14 @@ export class SelectBuilder {
 		return result
 	}
 
-	public async select(
+	public select(
 		mapper: Mapper,
 		entity: Model.Entity,
 		input: ObjectNode<Input.ListQueryInput>,
 		path: Path,
 		groupBy?: string,
 	) {
-		const promise = this.selectInternal(mapper, entity, path, input)
+		this.selectInternal(mapper, entity, path, input)
 		const where = input.args.filter
 		if (where) {
 			this.qb = this.whereBuilder.build(this.qb, entity, path, where)
@@ -76,11 +76,9 @@ export class SelectBuilder {
 			}
 			this.qb = this.qb.limit(input.args.limit, input.args.offset)
 		}
-
-		await promise
 	}
 
-	private async selectInternal(mapper: Mapper, entity: Model.Entity, path: Path, input: ObjectNode) {
+	private selectInternal(mapper: Mapper, entity: Model.Entity, path: Path, input: ObjectNode) {
 		if (!input.fields.find(it => it.name === entity.primary && it.alias === entity.primary)) {
 			input = input.withField(new FieldNode(entity.primary, entity.primary, {}))
 		}
@@ -142,8 +140,6 @@ export class SelectBuilder {
 		this.qb = this.qb.select([columnPath.back().getAlias(), columnName], columnPath.getAlias())
 		const rows = await this.rows
 		const columnAlias = columnPath.getAlias()
-		return rows
-			.map((it): Input.PrimaryValue => it[columnAlias] as Input.PrimaryValue)
-			.filter((val, index, all) => all.indexOf(val) === index)
+		return Array.from(new Set(rows.map((it): Input.PrimaryValue => it[columnAlias] as Input.PrimaryValue)))
 	}
 }

package/src/resolvers/MutationResolver.ts

@@ -378,12 +378,13 @@ export class MutationResolver {
 		if (errorResponse) {
 			return errorResponse
 		}
-		const primary = getInsertPrimary(result) || getUpdatePrimary(result)
-		if (!primary) {
+		const primary = getInsertPrimary(result)
+		const byResolved = primary ? { [entity.primary]: primary } : input.by
+		if (!byResolved) {
 			throw new ImplementationException('MutationResolver::resolveUpsertInternal does not handle result properly')
 		}
 
-		const nodes = await this.resolveResultNodes(mapper, entity, { [entity.primary]: primary }, queryAst)
+		const nodes = await this.resolveResultNodes(mapper, entity, byResolved, queryAst)
 		return {
 			ok: true,
 			validation: {

package/src/schema/EntityTypeProvider.ts

@@ -53,14 +53,14 @@ export class EntityTypeProvider {
 	}
 
 	public getEntity(entityName: string): GraphQLObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			throw new ImplementationException()
 		}
 		return this.entities(entityName)
 	}
 
 	public getConnection(entityName: string): GraphQLObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			throw new ImplementationException()
 		}
 		return this.connections(entityName)
@@ -100,7 +100,7 @@ export class EntityTypeProvider {
 
 		const fields: { [field: string]: GraphQLFieldConfig<any, any> } = accessibleFields.reduce(
 			(result, fieldName) => {
-				const fieldTypeVisitor = new FieldTypeVisitor(this.columnTypeResolver, this)
+				const fieldTypeVisitor = new FieldTypeVisitor(this.columnTypeResolver, this, this.authorizator)
 				const type: GraphQLOutputType = acceptFieldVisitor(this.schema, entity, fieldName, fieldTypeVisitor)
 
 				const fieldArgsVisitor = new FieldArgsVisitor(this.whereTypeProvider, this.orderByTypeProvider)

package/src/schema/FieldAccessVisitor.ts

@@ -8,10 +8,10 @@ export class FieldAccessVisitor implements Model.ColumnVisitor<boolean>, Model.R
 	) {}
 
 	visitColumn(entity: Model.Entity, column: Model.AnyColumn) {
-		return this.authorizator.isAllowed(this.operation, entity.name, column.name)
+		return this.authorizator.getFieldPermissions(this.operation, entity.name, column.name) !== 'no'
 	}
 
 	visitRelation({}, {}, targetEntity: Model.Entity) {
-		return this.authorizator.isAllowed(this.operation, targetEntity.name)
+		return this.authorizator.getEntityPermission(this.operation, targetEntity.name) !== 'no'
 	}
 }

package/src/schema/MutationProvider.ts

@@ -69,7 +69,7 @@ export class MutationProvider {
 		if (entity.view) {
 			return undefined
 		}
-		if (!this.authorizator.isAllowed(Acl.Operation.delete, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.delete, entityName) === 'no') {
 			return undefined
 		}
 		const uniqueWhere = this.whereTypeProvider.getEntityUniqueWhereType(entityName)
@@ -180,7 +180,7 @@ export class MutationProvider {
 			errorMessage: { type: GraphQLString },
 			errors: { type: this.resultSchemaTypeProvider.errorListResultType },
 		}
-		if (this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) !== 'no') {
 			const nodeType = this.entityTypeProvider.getEntity(entityName)
 			fields.node = { type: nodeType, resolve: aliasAwareResolver }
 		}

package/src/schema/QueryProvider.ts

@@ -19,7 +19,7 @@ export class QueryProvider {
 	) {}
 
 	public getQueries(entity: Model.Entity): { [fieldName: string]: GraphQLFieldConfig<any, Context, any> } {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entity.name)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entity.name) === 'no') {
 			return {}
 		}
 		return {

package/src/schema/WhereTypeProvider.ts

@@ -22,14 +22,14 @@ export class WhereTypeProvider {
 	) {}
 
 	public getEntityWhereType(entityName: string): GraphQLInputObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			throw new ImplementationException()
 		}
 		return this.whereSingleton(entityName)
 	}
 
 	public getEntityUniqueWhereType(entityName: string): undefined | GraphQLInputObjectType {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, entityName)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, entityName) === 'no') {
 			return undefined
 		}
 		return this.uniqueWhereSingleton(entityName)

package/src/schema/entities/FieldTypeVisitor.ts

@@ -1,20 +1,29 @@
 import { GraphQLList, GraphQLNonNull, GraphQLOutputType } from 'graphql'
-import { Model } from '@contember/schema'
+import { Acl, Model } from '@contember/schema'
 import { ColumnTypeResolver } from '../ColumnTypeResolver'
 import { EntityTypeProvider } from '../EntityTypeProvider'
+import { Authorizator } from '../../acl'
+import { ImplementationException } from '../../exception'
 
 export class FieldTypeVisitor implements Model.ColumnVisitor<GraphQLOutputType>, Model.RelationByGenericTypeVisitor<GraphQLOutputType> {
-	private columnTypeResolver: ColumnTypeResolver
-	private entityTypeProvider: EntityTypeProvider
-
-	constructor(columnTypeResolver: ColumnTypeResolver, entityTypeProvider: EntityTypeProvider) {
-		this.columnTypeResolver = columnTypeResolver
-		this.entityTypeProvider = entityTypeProvider
+	constructor(
+		private readonly columnTypeResolver: ColumnTypeResolver,
+		private readonly entityTypeProvider: EntityTypeProvider,
+		private readonly authorizator: Authorizator,
+	) {
 	}
 
 	public visitColumn(entity: Model.Entity, column: Model.AnyColumn): GraphQLOutputType {
 		const basicType = this.columnTypeResolver.getType(column)
-		return column.nullable ? basicType : new GraphQLNonNull(basicType)
+		const fieldPredicate = this.authorizator.getFieldPredicate(Acl.Operation.read, entity.name, column.name)
+		const idPredicate = this.authorizator.getFieldPredicate(Acl.Operation.read, entity.name, entity.primary)
+		if (!fieldPredicate || !idPredicate) {
+			throw new ImplementationException()
+		}
+		if (!column.nullable && (fieldPredicate === true || fieldPredicate === idPredicate)) {
+			return new GraphQLNonNull(basicType)
+		}
+		return basicType
 	}
 
 	public visitHasMany(entity: Model.Entity, relation: Model.Relation): GraphQLOutputType {

package/src/schema/mutations/CreateEntityInputFieldVisitor.ts

@@ -19,7 +19,7 @@ export class CreateEntityInputFieldVisitor implements
 		if (entity.primary === column.name && !this.authorizator.isCustomPrimaryAllowed(entity.name)) {
 			return undefined
 		}
-		if (!this.authorizator.isAllowed(Acl.Operation.create, entity.name, column.name)) {
+		if (this.authorizator.getFieldPermissions(Acl.Operation.create, entity.name, column.name) === 'no') {
 			return undefined
 		}
 		const type = this.columnTypeResolver.getType(column)

package/src/schema/mutations/CreateEntityRelationAllowedOperationsVisitor.ts

@@ -65,9 +65,9 @@ export class CreateEntityRelationAllowedOperationsVisitor implements
 	): Input.CreateRelationOperation[] {
 		const result: Input.CreateRelationOperation[] = []
 
-		const canReadTargetEntity = this.authorizator.isAllowed(Acl.Operation.read, targetEntity.name)
-		const canCreateTargetEntity = this.authorizator.isAllowed(Acl.Operation.create, targetEntity.name)
-		const canCreateOwning = this.authorizator.isAllowed(Acl.Operation.create, owningEntity.name, owningRelation.name)
+		const canReadTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.read, targetEntity.name) !== 'no'
+		const canCreateTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.create, targetEntity.name) !== 'no'
+		const canCreateOwning = this.authorizator.getFieldPermissions(Acl.Operation.create, owningEntity.name, owningRelation.name) !== 'no'
 
 		if (canReadTargetEntity && canCreateOwning) {
 			result.push(Input.CreateRelationOperation.connect)

package/src/schema/mutations/EntityInputProvider.ts

@@ -51,7 +51,7 @@ export class EntityInputProvider<Operation extends EntityInputType> {
 					throw new ImplementationException(`EntityInputProvider: Invalid operation ${this.operation}`)
 			}
 		})()
-		if (!this.authorizator.isAllowed(operation, entity.name)) {
+		if (this.authorizator.getEntityPermission(operation, entity.name) === 'no') {
 			return undefined
 		}
 

package/src/schema/mutations/UpdateEntityInputFieldVisitor.ts

@@ -18,7 +18,7 @@ export class UpdateEntityInputFieldVisitor implements
 		if (entity.primary === column.name) {
 			return undefined
 		}
-		if (!this.authorizator.isAllowed(Acl.Operation.update, entity.name, column.name)) {
+		if (this.authorizator.getFieldPermissions(Acl.Operation.update, entity.name, column.name) === 'no') {
 			return undefined
 		}
 		const type = this.columnTypeResolver.getType(column)

package/src/schema/mutations/UpdateEntityRelationAllowedOperationsVisitor.ts

@@ -76,15 +76,11 @@ export class UpdateEntityRelationAllowedOperationsVisitor implements
 	): Input.UpdateRelationOperation[] {
 		const result: Input.UpdateRelationOperation[] = []
 
-		const canReadTargetEntity = this.authorizator.isAllowed(Acl.Operation.read, targetEntity.name)
-		const canCreateTargetEntity = this.authorizator.isAllowed(Acl.Operation.create, targetEntity.name)
-		const canUpdateTargetEntity = this.authorizator.isAllowed(Acl.Operation.update, targetEntity.name)
-		const canDeleteTargetEntity = this.authorizator.isAllowed(Acl.Operation.delete, targetEntity.name)
-		const canUpdateOwningRelation = this.authorizator.isAllowed(
-			Acl.Operation.update,
-			owningEntity.name,
-			owningRelation.name,
-		)
+		const canReadTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.read, targetEntity.name) !== 'no'
+		const canCreateTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.create, targetEntity.name) !== 'no'
+		const canUpdateTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.update, targetEntity.name) !== 'no'
+		const canDeleteTargetEntity = this.authorizator.getEntityPermission(Acl.Operation.delete, targetEntity.name) !== 'no'
+		const canUpdateOwningRelation = this.authorizator.getFieldPermissions(Acl.Operation.update, owningEntity.name, owningRelation.name) !== 'no'
 
 		if (canReadTargetEntity && canUpdateOwningRelation) {
 			result.push(Input.UpdateRelationOperation.connect)

package/src/schema/mutations/UpdateEntityRelationInputFieldVisitor.ts

@@ -174,7 +174,7 @@ export class UpdateEntityRelationInputFieldVisitor implements
 	}
 
 	private createWhereInput(targetEntity: Model.Entity): GraphQLInputFieldConfig | undefined {
-		if (!this.authorizator.isAllowed(Acl.Operation.read, targetEntity.name)) {
+		if (this.authorizator.getEntityPermission(Acl.Operation.read, targetEntity.name) === 'no') {
 			return undefined
 		}
 		const uniqueWhere = this.whereTypeBuilder.getEntityUniqueWhereType(targetEntity.name)

package/tests/cases/integration/graphQlRequests/query/relations/oneHasMany.test.ts

@@ -416,4 +416,93 @@ test('Posts with paginated comments without count (one has many)', async () => {
 	})
 })
 
+
+test('Posts with paginated comments (one has many)', async () => {
+	await execute({
+		schema: new SchemaBuilder()
+			.entity('Post', entity => entity.oneHasMany('comments', relation => relation.target('Comment').ownedBy('post')))
+			.entity('Comment', entity => entity.column('content').column('deletedAt', c => c.type(Model.ColumnType.DateTime)))
+			.buildSchema(),
+		query: GQL`
+        query {
+          listPost {
+            id
+            comments: paginateComments(filter: {deletedAt: {isNull: true}}, first: 1) {
+				pages: pageInfo {
+					count: totalCount
+				}
+				comments: edges {
+					comment: node {
+						content
+					}
+				}
+            }
+          }
+        }
+			`,
+		executes: [
+			{
+				sql: SQL`select
+                       "root_"."id" as "root_id",
+                       "root_"."id" as "root_id"
+                     from "public"."post" as "root_"`,
+				response: {
+					rows: [{ root_id: testUuid(1) }],
+				},
+			},
+			{
+				sql: SQL`select
+       				count(*) as "row_count", "root_"."post_id"
+					from "public"."comment" as "root_"
+					where "root_"."deleted_at" is null and "root_"."post_id" in (?)
+					group by "root_"."post_id"`,
+				parameters: [testUuid(1)],
+				response: {
+					rows: [
+						{ post_id: testUuid(1), row_count: 5 },
+					],
+				},
+			},
+			{
+				sql: SQL`with "data" as
+    				(select
+    				    "root_"."post_id" as "__grouping_key",
+    				    "root_"."content" as "root_content",
+    					"root_"."id" as "root_id",
+    				    row_number() over(partition by  "root_"."post_id" order by "root_"."id" asc) as "rowNumber_"
+    					from "public"."comment" as "root_"
+    					where "root_"."deleted_at" is null
+    					      and "root_"."post_id" in (?)
+    					order by "root_"."id" asc)
+					select "data".*  from "data"   where "data"."rowNumber_" <= ?`,
+				parameters: [testUuid(1), 1],
+				response: {
+					rows: [
+						{ __grouping_key: testUuid(1), root_id: testUuid(3), root_content: 'Lorem ipsum' },
+					],
+				},
+			},
+		],
+		return: {
+			data: {
+				listPost: [
+					{
+						id: testUuid(1),
+						comments: {
+							pages: {
+								count: 5,
+							},
+							comments: [
+								{
+									comment: { content: 'Lorem ipsum' },
+								},
+							],
+						},
+					},
+				],
+			},
+		},
+	})
+})
+
 test.run()

package/tests/cases/integration/graphQlRequests/upsert/basicUpsert.test.ts

@@ -98,8 +98,54 @@ test('upsert author (exists)', async () => {
 					response: { rowCount: 1 },
 				},
 				{
-					sql: SQL`select "root_"."id" as "root_id"  from "public"."author" as "root_"  where "root_"."id" = ?`,
-					parameters: [testUuid(2)],
+					sql: SQL`select "root_"."id" as "root_id"  from "public"."author" as "root_"  where "root_"."slug" = ?`,
+					parameters: ['john-doe'],
+					response: { rows: [{ root_id: testUuid(2) }] },
+				},
+			]),
+		],
+		return: {
+			data: {
+				upsertAuthor: {
+					ok: true,
+					node: {
+						id: testUuid(2),
+					},
+				},
+			},
+		},
+	})
+})
+
+test('upsert author (exists) with noop update)', async () => {
+	await execute({
+		schema: new SchemaBuilder()
+			.entity('Author', entity =>
+				entity
+					.column('name', c => c.type(Model.ColumnType.String))
+					.column('slug', c => c.type(Model.ColumnType.String).unique()),
+			)
+			.buildSchema(),
+		query: GQL`
+          mutation {
+              upsertAuthor(by: {slug: "john-doe"}, update: {}, create: {slug: "john-doe", name: "John Doe"}) {
+                  ok
+                  node {
+                      id
+                  }
+              }
+          }`,
+		executes: [
+			...sqlTransaction([
+				{
+					sql: SQL`select "root_"."id"
+					from "public"."author" as "root_"  where "root_"."slug" = ?`,
+					parameters: ['john-doe'],
+					response: { rows: [{ id: testUuid(2) }] },
+				},
+				{
+					sql: SQL`select "root_"."id" as "root_id"  from "public"."author" as "root_"  where "root_"."slug" = ?`,
+					parameters: ['john-doe'],
 					response: { rows: [{ root_id: testUuid(2) }] },
 				},
 			]),
@@ -117,3 +163,4 @@ test('upsert author (exists)', async () => {
 	})
 })
 test.run()
+

package/tests/cases/integration/graphQlSchema/graphQlSchemaBuilder.test.ts

@@ -3,7 +3,7 @@ import { Acl, Model } from '@contember/schema'
 import * as path from 'path'
 
 import { AllowAllPermissionFactory, SchemaBuilder, SchemaDefinition } from '@contember/schema-definition'
-import { GraphQlSchemaBuilderFactory, StaticAuthorizator } from '../../../../src'
+import { GraphQlSchemaBuilderFactory, Authorizator } from '../../../../src'
 import * as model from './model'
 import { promises as fs } from 'fs'
 import * as assert from 'uvu/assert'
@@ -23,7 +23,7 @@ const testSchema = async (test: Test) => {
 	const schema = schemaResult instanceof SchemaBuilder ? schemaResult.buildSchema() : schemaResult
 	const schemaWithAcl = { ...schema, acl: { roles: {}, variables: {} } }
 	const permissions = test.permissions(schemaWithAcl)
-	const authorizator = new StaticAuthorizator(permissions)
+	const authorizator = new Authorizator(permissions)
 	const graphQlSchemaBuilder = schemaFactory.create(schemaWithAcl, authorizator)
 	const graphQlSchema = graphQlSchemaBuilder.build()
 
@@ -110,6 +110,61 @@ graphqlSchemaBuilderTest('restricted access to fields by permissions', async ()
 		graphQlSchemaFile: 'schema-acl.gql',
 	})
 })
+
+
+graphqlSchemaBuilderTest('conditionally restricted read of some fields', async () => {
+	await testSchema({
+		schema: builder =>
+			builder.entity('Test', e =>
+				e
+					.column('a', c => c.type(Model.ColumnType.String).notNull()),
+			),
+		permissions: () => ({
+			Test: {
+				predicates: {
+					testPredicate: {
+						a: { eq: 'Foo' },
+					},
+				},
+				operations: {
+					read: {
+						id: true,
+						a: 'testPredicate',
+					},
+				},
+			},
+		}),
+		graphQlSchemaFile: 'schema-acl-predicate.gql',
+	})
+})
+
+
+graphqlSchemaBuilderTest('conditionally restricted read of whole row', async () => {
+	await testSchema({
+		schema: builder =>
+			builder.entity('Test', e =>
+				e
+					.column('a', c => c.type(Model.ColumnType.String).notNull()),
+			),
+		permissions: () => ({
+			Test: {
+				predicates: {
+					testPredicate: {
+						a: { eq: 'Foo' },
+					},
+				},
+				operations: {
+					read: {
+						id: 'testPredicate',
+						a: 'testPredicate',
+					},
+				},
+			},
+		}),
+		graphQlSchemaFile: 'schema-acl-predicate2.gql',
+	})
+})
+
 const oneHasManySchema = (builder: SchemaBuilder) =>
 	builder.entity('Root', e =>
 		e