FilterExpression with Field level SecurityChecks

[white3km]

Hello, I previously had an entity with class level ReadPermissions which worked with a FilterExpression. Now we've had to add in some field level ReadPermission annotations which seems to break the FilterExpression.

Is this a bug or is there any way to ensure the FilterExpression runs before all user checks?

Example:

@ReadPermission(expression = "FilterExpression AND (UserCheckA OR UserCheckB)")
public class Apple{
    private String type;
    private String color;

    String getType(){}

    @ReadPermission(expression = "UserCheckA")
    String getColor(){}
}

[aklish]

A couple of things to help clarify:

• For read permissions, all checks are field checks. The ReadPermission at the top of the class just means every field defaults to that check.
• When reading a collection, if any field can be read, that entity will be returned in the response (masking fields where permission is denied).
• This translates to the following condition on the collection: FilterExpression AND (UserCheckA OR UserCheckB) OR UserCheckA
• If there is a logical OR between a filter check and another check (user or operation), Elide will have to perform this check in memory rather than push the filter expression to the datastore. This explains the behavior you are seeing.

Hope this makes sense.