Skip to content

ChangesetConnectionResolver.PageInfo needs to respect repository permissions

Created by: mrnugget

The changesetConnectionResolver.PageInfo method doesn't take repository permissions into account when responding whether there's a next page or not:

https://github.com/sourcegraph/sourcegraph/blob/402b61a52ba6a36480eff5e827e963c2482ea7f0/enterprise/internal/campaigns/resolvers/changesets.go#L131-L138

It simply uses the next value returned by r.compute. But r.compute potentially filters out the changesets based on repository permissions, which could make next invalid.