after the current changes are made and the tests pass

Reviewed 1 of 3 files at r1, 1 of 3 files at r2, 4 of 4 files at r3.
Reviewable status: all files reviewed, 8 unresolved discussions (waiting on @animesh2049 and @manishrjain)

edgraph/access_ee.go, line 789 at r1 (raw file):

			addUserFilterToQuery(gq, userId, groupIds)
		}
		for _, pred := range x.AllACLPredicates() {

Add a comment here that the query could have ACL predicates which could be part of the blocked preds and we want to allow access to them, hence we delete them from the blocked preds map.

edgraph/access_ee.go, line 786 at r3 (raw file):

	if len(blockedPreds) != 0 {
		if graphql {

Add a comment saying

For GraphQL requests, we allow filtered access to the ACL predicates. Filter for user_id and group_id is applied for the currently logged in user.

edgraph/access_ee.go, line 833 at r3 (raw file):

// addUserFilterToQuery applies makes sure that a user can access only its own
// acl info by applying filter of userid and groupid to acl predicates

me(func: type(Group))

me(func: type(Group)) @filter(eq(dgraph.xid, ["group1", "group2",..]))

similarly for User.

edgraph/access_ee.go, line 857 at r3 (raw file):

	case "dgraph.user.group":
		newFilter := groupFilter(groupIds)
		gq.Filter = parentFilter(newFilter, gq.Filter)

No need to return the pointer here, the function can just update gq.Filter.

edgraph/access_ee.go, line 860 at r3 (raw file):

	case "~dgraph.user.group":
		newFilter := userFilter(userId)
		gq.Filter = parentFilter(newFilter, gq.Filter)

same here

edgraph/access_ee.go, line 916 at r3 (raw file):

		}
*/
func addUserFilterToFilter(filter *gql.FilterTree, userId string,

We can update filter in place

Reviewable status: 5 of 6 files reviewed, 9 unresolved discussions (waiting on @filter, @golangcibot, @manishrjain, and @pawanrawal)

edgraph/access_ee.go, line 789 at r1 (raw file):

Done.

edgraph/access_ee.go, line 852 at r1 (raw file):

Done.

edgraph/access_ee.go, line 849 at r2 (raw file):

Done.

edgraph/access_ee.go, line 786 at r3 (raw file):

Done.

edgraph/access_ee.go, line 833 at r3 (raw file):

Done.

edgraph/access_ee.go, line 857 at r3 (raw file):

for that I will have to do something like this

updateFilter(newFilter, &gq.Filter)

func updateFilter(newFilter *gql.Filter, filter **gql.Filter) {
    if **filter == nil {
        *filter = newFilter
...

The current version seems more appropriate to me, so leaving reverted my commit.

edgraph/access_ee.go, line 860 at r3 (raw file):

Same as above.

edgraph/access_ee.go, line 916 at r3 (raw file):

Same as above.

edgraph/access_ee.go, line 886 at r4 (raw file):

Done.