graphql: Apply type filter for get query at root level.

graphql/resolve/auth_query_test.yaml

@@ -1,3 +1,43 @@
+- name: "Auth with deep get query."
+  gqlquery: |
+    query {
+      getProject(projID: "0x123") {
+        projID
+        columns {
+          name
+          colID
+        }
+      }
+    }
+  dgquery: |-
+    query {
+      getProject(func: uid(Project2)) @filter((uid(Project3) AND type(Project))) {
+        projID : uid
+        columns : Project.columns @filter(uid(Column1)) {
+          name : Column.name
+          colID : uid
+        }
+      }
+      Project2 as var(func: uid(0x123))
+      Project3 as var(func: uid(Project2)) @cascade {
+        roles : Project.roles @filter(eq(Role.permission, "VIEW")) {
+          assignedTo : Role.assignedTo @filter(eq(User.username, "user1"))
+          dgraph.uid : uid
+        }
+        dgraph.uid : uid
+      }
+      Column1 as var(func: type(Column)) @cascade {
+        inProject : Column.inProject {
+          roles : Project.roles @filter(eq(Role.permission, "VIEW")) {
+            assignedTo : Role.assignedTo @filter(eq(User.username, "user1"))
+            dgraph.uid : uid
+          }
+          dgraph.uid : uid
+        }
+        dgraph.uid : uid
+      }
+    }
+
 - name: "Auth with top level filter : query, no filter"
   gqlquery: |
     query {
@@ -26,11 +66,11 @@
     }
   dgquery: |-
     query {
-      getUserSecret(func: uid(UserSecret1)) @filter(uid(UserSecret2)) {
+      getUserSecret(func: uid(UserSecret1)) @filter((uid(UserSecret2) AND type(UserSecret))) {
         id : uid
         ownedBy : UserSecret.ownedBy
       }
-      UserSecret1 as var(func: uid(0x123)) @filter(type(UserSecret))
+      UserSecret1 as var(func: uid(0x123))
       UserSecret2 as var(func: uid(UserSecret1)) @filter(eq(UserSecret.ownedBy, "user1")) @cascade
     }
 

graphql/resolve/auth_test.go

@@ -492,7 +492,7 @@ func checkAddUpdateCase(
 	}
 }
 
-func TestAuthSchemaRewriting(t *testing.T) {
+func TestAuthQueryRewriting(t *testing.T) {
 	sch, err := ioutil.ReadFile("../e2e/auth/schema.graphql")
 	require.NoError(t, err, "Unable to read schema file")
 

graphql/resolve/query_rewriter.go

@@ -235,6 +235,31 @@ func addArgumentsToField(dgQuery *gql.GraphQuery, field schema.Field) {
 	addPagination(dgQuery, field)
 }
 
+func addTopLevelTypeFilter(query *gql.GraphQuery, field schema.Field) {
+	if query.Attr != "" {
+		addTypeFilter(query, field.Type())
+		return
+	}
+
+	var rootQuery *gql.GraphQuery
+	for _, q := range query.Children {
+		if q.Attr == field.Name() {
+			rootQuery = q
+			break
+		}
+		for _, cq := range q.Children {
+			if cq.Attr == field.Name() {
+				rootQuery = cq
+				break
+			}
+		}
+	}
+
+	if rootQuery != nil {
+		addTypeFilter(rootQuery, field.Type())
+	}
+}
+
 func rewriteAsGet(
 	field schema.Field,
 	uid uint64,
@@ -250,17 +275,10 @@ func rewriteAsGet(
 	if xid == nil {
 		dgQuery = rewriteAsQueryByIds(field, []uint64{uid}, auth)
 
-		// If the top level query is the named get, put the type filter there, otherwise
-		// auth has been written into the query, then there will be a blank top level
-		// and multiple children, of which the second is the actual get
-		if dgQuery.Attr != "" {
-			addTypeFilter(dgQuery, field.Type())
-		} else {
-			addTypeFilter(dgQuery.Children[1], field.Type())
-		}
-
+		// Add the type filter to the top level get query. When the auth has been written into the
+		// query the top level get query may be present in query's children.
+		addTopLevelTypeFilter(dgQuery, field)
 		return dgQuery
-
 	}
 
 	xidArgName := field.XIDArg()