Soft delete implementation does not account for relationships

[qbunt]

We've configured soft deletes for the project under the same guidance as is in the docs but there is an implementation detail that seems like it's been forgotten.

When you have a record with deleted_at in the row, and you're not able to query for it directly, the rules to check for deleted_at are working correctly. However, when you query for a deeply nested relationship with the deleted_at property on the record, you still see that soft-deleted record. You can also see this record when querying for aggregations, as the deleted_at rule is seemingly not respected when queried through a relationship.

Is there a way to achieve this with the directed method of handling soft-deletes, or is this a limitation of Hasura?

[harishnair96]

Hi @qbunt . We were unable to reproduce this issue. However from what you are describing, it seems like the permission checks are not being respected in some cases, am I correct? If so, then it is definitely an issue. We would like to gather more details from you to reproduce this issue and for that we have created a ticket on your behalf for this issue. You would have received this ticket at the email [email protected]. Let us know if you didn't.

[qbunt]

Pursuing this through our account rep, thank you for getting back to me, I am sure there's a ticket number floating around internally for this. It turns out that it related more to aggregation counts and soft-deletes not agreeing.

For instance, if you have soft-deleted a user, the user object would still be included in the aggregate.count query regardless of the rule that filters via deleted_at, is_null , false

That @[email protected] is my Mastodon account, not an email, but no further action necessary, thanks!

[harishnair96]

Thanks for confirming that. But we were unable to reproduce the issue with aggregations as well. Also you did mention that -

when you query for a deeply nested relationship with the deleted_at property on the record, you still see that soft-deleted record

Was this a mistake? Also can you let us know which version of Hasura you are using so that we can try reproducing the issue with aggregation queries?

[email protected] is my Mastodon account, not an email

Ah my bad. I thought it would have email capabilities as well. We can continue the discussion here if you would like.