diff --git a/edgraph/access_ee.go b/edgraph/access_ee.go index 0ca838cd4dd..d40b4405ecd 100644 --- a/edgraph/access_ee.go +++ b/edgraph/access_ee.go @@ -721,8 +721,10 @@ func parsePredsFromQuery(gqls []*gql.GraphQuery) predsAndvars { } preds := make([]string, 0, len(predsMap)) for pred := range predsMap { - if _, found := varsMap[pred]; !found { - preds = append(preds, pred) + if len(pred) > 0 { + if _, found := varsMap[pred]; !found { + preds = append(preds, pred) + } } } diff --git a/ee/acl/acl_test.go b/ee/acl/acl_test.go index 1768cc88519..b1d7a6e1722 100644 --- a/ee/acl/acl_test.go +++ b/ee/acl/acl_test.go @@ -1397,6 +1397,28 @@ func TestValQueryWithACLPermissions(t *testing.T) { `{"q1":[{"name":"RandomGuy","age":23},{"name":"RandomGuy2","age":25}], "q2":[{"name":"RandomGuy2","val(n)":"RandomGuy2","val(a)":25},{"name":"RandomGuy","val(n)":"RandomGuy","val(a)":23}]}`, }, + { + `{ + f as q1(func: has(name), orderasc: name) { + name + age + } + q2(func: uid(f), orderasc: name) { + name + age + } + }`, + "alice doesn't have access to name or age", + `{"q2":[]}`, + + `alice has access to name`, + `{"q1":[{"name":"RandomGuy"},{"name":"RandomGuy2"}], + "q2":[{"name":"RandomGuy"},{"name":"RandomGuy2"}]}`, + + "alice has access to name and age", + `{"q1":[{"name":"RandomGuy","age":23},{"name":"RandomGuy2","age":25}], + "q2":[{"name":"RandomGuy2","age":25},{"name":"RandomGuy","age":23}]}`, + }, } userClient, err := testutil.DgraphClient(testutil.SockAddr)