policy.field_widens_entity

A field's own policy: lets in someone its record's grants don't.

Area 9, Policy; not declinable; the next step is usually the agent's.

Why Jadpo refuses it

A field follows its record's grants unless its own policy: says otherwise, and a field's policy: can only take away. To read a field, a caller must first be allowed to read the record it is in. So a field list naming someone the record's list doesn't name lets nobody extra in, and it reads as if it does.

Here Note.summary names anyone signed in, but only a note's owner may read the note, so its summary is the owner's too.

What it looks like

main.jadpo:

type Handle = Text {    max_length: 40}entity User {    id: Uuid    handle: Handle {        unique: true    }}principal {    user: {        subject: User.handle    }}type NoteText = Text {    max_length: 200}entity Note {    id: Uuid    owner_id: User.id {        on_delete: OnDelete.cascade    }    text: NoteText    summary: NoteText {        policy: {            read: [Access.authenticated]        }    }    policy: {        read: [owner_id]    }}

   |30 |             read: [Access.authenticated]   |                    ^^^^^^^^^^^^^^^^^^^^ not in `Note`'s `read:`

(agent) at the end of the next: line means your coding agent can make the fix itself.

How to fix it

The question is who should read the summary.

If only the note's owner should, remove the field's policy:, so summary follows Note's grants:

    text: NoteText    summary: NoteText    policy: {        read: [owner_id]    }

Only the owner reads a note and its summary, as before, and the field no longer reads as if anyone else can.

If anyone signed in should read the summary, widen the record's read: to them, and narrow the fields only the owner may read:

    text: NoteText {        policy: {            read: [owner_id]        }    }    summary: NoteText    policy: {        read: [Access.authenticated]    }

Anyone signed in may now read a note's id, owner_id and summary, and only its owner may read its text. A query whose output carries text is then refused, since not everyone who may read a note may read its text (policy.output_field_unproved).

Related

• Field restrictions
• Grants
• Anyone signed in, or anyone