Don't call db.onConnect with a sudo context (#7955)

Co-authored-by: Daniel Cousens <dcousens@users.noreply.github.com>
keystonejs · Sep 26, 2022 · 6497e1c · 6497e1c
1 parent 52da098
commit 6497e1c
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 6 deletions.
diff --git a/.changeset/binary-eats-grass.md b/.changeset/binary-eats-grass.md
@@ -0,0 +1,5 @@
+---
+'@keystone-6/core': major
+---
+
+`db.onConnect` is now called with an unprivileged context, **not sudo**.  Use `context.sudo()` if you need to bypass access control
diff --git a/packages/core/src/lib/createSystem.ts b/packages/core/src/lib/createSystem.ts
@@ -78,6 +78,7 @@ export function createSystem(config: KeystoneConfig, isLiveReload?: boolean) {
         log: config.db.enableLogging ? ['query'] : undefined,
         datasources: { [config.db.provider]: { url: config.db.url } },
       });
+
       setWriteLimit(prismaClient, pLimit(config.db.provider === 'sqlite' ? 1 : Infinity));
       setPrismaNamespace(prismaClient, prismaModule.Prisma);
       prismaClient.$on('beforeExit', async () => {
@@ -101,14 +102,13 @@ export function createSystem(config: KeystoneConfig, isLiveReload?: boolean) {
 
       return {
         async connect() {
-          if (!isLiveReload) {
-            await prismaClient.$connect();
-            const context = createContext({ sudo: true });
-            await config.db.onConnect?.(context);
-          }
+          if (isLiveReload) return;
+
+          await prismaClient.$connect();
+          const context = createContext();
+          await config.db.onConnect?.(context);
         },
         async disconnect() {
-          // Tests that use the stored session won't stop until the store connection is disconnected
           await config?.session?.disconnect?.();
           await prismaClient.$disconnect();
         },