The transport-only key carrying the server's authoritative answer to "which fields on this
entity may the caller of THIS request read".
Why it lists READABLE fields rather than denied ones. The two carry the same information
only while the client already holds the full permission matrix, which it does today — the
MJ_Metadata dataset ships MJ: Entity Fields and MJ: Entity Field Permissions unfiltered.
That is scheduled to change (MJ issue #3485, metadata filtering for restricted users), and a
payload that named DENIED fields would hand back exactly what such filtering exists to withhold:
the names of columns you are not allowed to know about. A readable list names only fields the
caller may already see, so it discloses nothing under any filtering design.
Why it is needed at all. The server omits denied fields from the response object, but
GraphQL emits every SELECTED field regardless — so a denied field the client asked for arrives
as an explicit null, indistinguishable from a genuine one. The client cannot settle that from
its own metadata: in the window after a permission change (and permanently, once metadata is
filtered) the client's copy disagrees with the server's. This key is the server stating it
in-band, for the request that actually ran.
Suffixed ___ following the established transport-only convention (OldValues___,
RestoreContext___) so it cannot collide with a real column name.
The transport-only key carrying the server's authoritative answer to "which fields on this entity may the caller of THIS request read".
Why it lists READABLE fields rather than denied ones. The two carry the same information only while the client already holds the full permission matrix, which it does today — the
MJ_Metadatadataset shipsMJ: Entity FieldsandMJ: Entity Field Permissionsunfiltered. That is scheduled to change (MJ issue #3485, metadata filtering for restricted users), and a payload that named DENIED fields would hand back exactly what such filtering exists to withhold: the names of columns you are not allowed to know about. A readable list names only fields the caller may already see, so it discloses nothing under any filtering design.Why it is needed at all. The server omits denied fields from the response object, but GraphQL emits every SELECTED field regardless — so a denied field the client asked for arrives as an explicit
null, indistinguishable from a genuine one. The client cannot settle that from its own metadata: in the window after a permission change (and permanently, once metadata is filtered) the client's copy disagrees with the server's. This key is the server stating it in-band, for the request that actually ran.Suffixed
___following the established transport-only convention (OldValues___,RestoreContext___) so it cannot collide with a real column name.