feat(#4848) - Return only isVisible Tags, unless admin

[machikoyasuda]

Resolves #4848
Impact: minor
Type: feature

Issue

The current Tags query returns all in the collection, even if a tag's isVisible is set to false. To make sure the public cannot view the tag listing pages of certain tags, the Tags query should default to only returning isVisible tags.

Solution

• Adds a shouldIncludeInvisible parameter to the main query, set to false by default
• Add a check for Admin status before shouldIncludeInvisible can return all tags
• Unit tests

Breaking changes

None

Testing

0. Mark some tags as isVisible == false
1. Test that an Admin can get all Tags, including Invisible tags
2. Test that a non-Admin can only get Visible tags
3. Test tag and tags queries

[mikemurray]

Should isActive be removed?

[machikoyasuda]

Ooooops.... 😅

[mikemurray]

If shouldIncludeInvisible === true but you're not an admin user, you will end up getting the invisible and visible tags.

What's even more interesting, if shouldIncludeDeleted = true you can see deleted tags as well.

The logic in the function needs a bit of a rework. I think you should check if the user is an admin or not, then decide if they get to see isVisible:true or isDeleted:true tags. Then for everyone else, they don't get to see invisible or deleted products.

if isAdmin
    shouldIncludeInvisible (add proper flags to query)
    shouldIncludeDeleted (add proper flags to query)
else
   only show visible and not delete tags

[mikemurray]

I can see a single tag marked as isVisible=false for the following query as both an admin and guest when shouldIncludeInvisible=false

"hats" was marked as isVisible = false

    tag(slugOrId: "hats") {
      name
      slug
      isVisible
      displayTitle
    }

I think you need to add this same login to the tag (singular) query as well.

[mikemurray]

👍