Able to query records with acl set to public:false about skygear-server HOT 5 CLOSED

And I don’t know why the _access settings become [{"level":""}] instead of the intended [{"public": false}].

from skygear-server.

I just tried with this ACL settings and record:query returns the record anyway:

                {
                    "level": "read",
                    "relation": "$direct",
                    "user_id": "713a3a64-743d-4e79-9b43-cb3ea888b504"
                }

from skygear-server.

Turns out [{"public": false}] is undefined and should not appear in the database.

from skygear-server.

This is due to the request lacking database_id field, and this cause the query handler to ignore ACL.

from skygear-server.

superseded by #58

from skygear-server.