What does defaultPermission do?

[Atlinx]

On the Typetta documentation for security, this example is given:

const entityManager = new EntityManager({
  security: {
    // context is generated by authorisation
    context: {
      permissions: {
        'VIEW_POSTS': [{ userId: 2}],
        'VIEW_POSTS_CONTENT': true
      }
    },
    policies: {
      post: {
        domain: {
          userId: 'creatorId'
        },
        permissions: {
          VIEW_POSTS: PERMISSION.READ_ONLY,
          VIEW_POSTS_CONTENT: {
            read: {
              id: true,
              content: true,
            }
          },
        },
        defaultPermissions: PERMISSION.DENY,
      },
    },
    defaultPermissions: PERMISSION.DENY
  }
)

Given this configuration, by performing a simple findAll operation on the DAO of the Post entity, the system applies the VIEW_POSTS_CONTENT permission because, in the absence of an explicit security domain, it is the most restrictive. Consequently, the following operation:

const posts = dao.post.findAll();

I'm wondering why VIEW_POSTS_CONTENT is considered to be the most restrictive permission, because defaultPermissions denies everything, therefore shouldn't defaultPermissions be the most restrictive permission that's applied?

[minox86]

defaultPermissions is a fallback, it's applied only if there's no other applicable policies. If you query for posts Typetta will apply the given post policy if you query for another entity without an explicit policy Typetta will fallback to the defaultPermissions.

[Atlinx]

Ah it looks like I had mistakenly assumed EntityManager to be a something that constantly persists and where a new context gets passed into every request. I didn't realize a new EntityManager is created whenever you want to pass in a new context.

The reason why dao.post.findAll() applies VIEW_POSTS_CONTENT is because the context of that entity manager is

context: {
  permissions: {
    'VIEW_POSTS': [{ userId: 2}],
    'VIEW_POSTS_CONTENT': true
  }
},

If it were empty, ie:

context: {
  permissions: {
  }
},

It would use the defaultPermissions fallback.