Answers.Body: <p>You can do this using a custom module that adds an <code>authorId</code> condition to element queries, for <code>graphql/api</code> requests.</p>
  
  <pre class="lang-php prettyprint-override"><code>use Craft;
  use craft\elements\db\EntryQuery;
  use yii\base\Event;
  use yii\web\ForbiddenHttpException;
  
  // ...
  
  // Is this a GraphQL request?
  if (Craft::$app-&gt;request-&gt;getActionSegments() == ['graphql', 'api']) {
      Event::on(EntryQuery::class, EntryQuery::EVENT_BEFORE_PREPARE, function(Event $event) {
          // Get the current user
          $user = Craft::$app-&gt;user-&gt;identity;
  
          // If no one is logged in, return a 403 error
          if (!$user) {
              throw new ForbiddenHttpException();
          }
  
          // Only Editors are allowed to see everything
          if (!$user-&gt;isInGroup('editors')) {
              /** @var EntryQuery $query */
              $query = $event-&gt;sender;
              $query-&gt;subQuery-&gt;andWhere(['authorId' =&gt; $user-&gt;id]);
          }
      });
  }
  </code></pre>
  
  <p><strong>Note:</strong> Since the results will start changing for the same element query depending on who is logged in, you’ll also need to disable the <a href="https://docs.craftcms.com/v3/config/config-settings.html#enablegraphqlcaching" rel="noreferrer">enableGraphQlCaching</a> config setting.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-08-23T17:48:09.623Z
Answers.Text: Make sure you are using the correct config name for your Craft version:
  `enableGraphQlCaching` before Craft CMS 3.7 and `enableGraphqlCaching` after Craft CMS 3.7
Answers.UserDisplayName: Ottó Radics
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-04-28T21:35:47.127Z
Answers.LastActivityDate: 2020-04-28T21:45:00.817Z
Answers.LastEditDate: 2020-04-28T21:45:00.817Z
Answers.UserDisplayName: Brandon Kelly
Body: <p>How can we filter what entries are returned by a GraphQL query so that users cannot see entries authored by other people?</p>
  
  <p>For example, <em>Editors</em> can access everything but <em>Writers</em> can only access their own entries.</p>
  
Tags: <graphql>
Title: GraphQL: Prevent users seeing entries authored by other users
ThreadText: # GraphQL: Prevent users seeing entries authored by other users
  
  (Asked by: username_0 on 2020-04-28)
  
  How can we filter what entries are returned by a GraphQL query so that users cannot see entries authored by other people?
  
  For example, *Editors* can access everything but *Writers* can only access their own entries.
  
  **Tags:** graphql
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-04-28. Score: 6 | Accepted answer
  
  You can do this using a custom module that adds an `authorId` condition to element queries, for `graphql/api` requests.
  
  ```php
  use Craft;
  use craft\elements\db\EntryQuery;
  use yii\base\Event;
  use yii\web\ForbiddenHttpException;
  
  // ...
  
  // Is this a GraphQL request?
  if (Craft::$app->request->getActionSegments() == ['graphql', 'api']) {
      Event::on(EntryQuery::class, EntryQuery::EVENT_BEFORE_PREPARE, function(Event $event) {
          // Get the current user
          $user = Craft::$app->user->identity;
  
          // If no one is logged in, return a 403 error
          if (!$user) {
              throw new ForbiddenHttpException();
          }
  
          // Only Editors are allowed to see everything
          if (!$user->isInGroup('editors')) {
              /** @var EntryQuery $query */
              $query = $event->sender;
              $query->subQuery->andWhere(['authorId' => $user->id]);
          }
      });
  }
  
  ```
  
  **Note:** Since the results will start changing for the same element query depending on who is logged in, you’ll also need to disable the [enableGraphQlCaching](https://docs.craftcms.com/v3/config/config-settings.html#enablegraphqlcaching) config setting.
  
  > **Comments:**
  > **username_2**: Make sure you are using the correct config name for your Craft version: `enableGraphQlCaching` before Craft CMS 3.7 and `enableGraphqlCaching` after Craft CMS 3.7  
  
  ---
  
  