Skip to content
VSKI

VSKI v0.11.1

Fix: per-item access rules on graphs

Section titled “Fix: per-item access rules on graphs”

Graph list and read endpoints evaluate their access rule twice: once as a gate when the request arrives (no node or edge in hand yet), then again per item. The gate ran the rule with no item data, so any rule that referenced item fields - for example listRule: "label = 'public'" - failed evaluation at the gate and every non-admin request errored out. The per-item pass documented in v0.10.0 (filtering, scan-ahead, "filtered": true responses) never ran.

The gate now defers to the per-item evaluation when a rule references item fields:

  • empty rules still deny, "*" and auth-only rules (@request.auth.id != '') still decide at the gate, and malformed rules still error;
  • single reads (GET .../nodes/:nodeId, .../edges/:edgeId) apply viewRule per item, so a field-based view rule hides individual items instead of failing the request;
  • list endpoints filter with the documented scan-ahead and report "filtered": true, counting only visible items;
  • traversal endpoints (neighbors, traverse, path, subgraph, stats) remain strictly gated by viewRule with no per-item pass, unchanged.

The behaviour is covered end-to-end in both the Deno and Python graph suites: a field-based listRule/viewRule against a non-admin client, including the filtered flag and per-node denial.

Documentation

Section titled “Documentation”

The project wiki gained a Graphs reference page and a knowledge-graph tutorial - linking collection records through a graph (works_on/authored/ depends_on edges), traversal queries, a sync pattern for record changes, rules, and the dashboard explorer. The Collections page was corrected along the way: select fields take options: { values: [...] }, not an array.

Compatibility

Section titled “Compatibility”
  • No API, storage or SDK changes: @vski/sdk stays at 2.1.1, vski-sdk at 0.4.1.
  • Rules that already worked behave identically; requests that previously errored (field-referencing rules) now return filtered results.
  • Full-suite runs still show the environment-flaky gates/realtime/workflow-hook tests known from earlier releases - failing sets vary between runs of the same binary, and they reproduce on the committed v0.10.x baseline with clean data. The graph suite passes consistently.