fix: omit field default value if read access returns false

[JarrodMFlesch]

Description

If the user does not have access to a field, do not send back the default value.

• I have read and understand the CONTRIBUTING.md document in this repository.

Type of change

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• I have added tests that prove my fix is effective or that my feature works
• Existing test suite passes locally with my changes
• I have made corresponding changes to the documentation

[tylandavis]

Wouldn't this be a breaking change? If my frontend is expecting a default value and now is getting null, that could be a problem.

To me, returning no value goes against what we've said in the docs:

Fields can be prefilled with starting values using the defaultValue property. This is used in the admin UI and also on the backend as API requests will be populated with missing or undefined field values.

[JarrodMFlesch]

Wouldn't this be a breaking change? If my frontend is expecting a default value and now is getting null, that could be a problem.

To me, returning no value goes against what we've said in the docs:

Fields can be prefilled with starting values using the defaultValue property. This is used in the admin UI and also on the backend as API requests will be populated with missing or undefined field values.

I am confused why the frontend would expect a value if the user cannot read the field though? I am seeing this from a "I request a document and it has a field I cannot read on it" POV, even though I cannot read the saved value, I still get a (incorrect) value back?

I might be missing something, but it seems a bit odd to me.

[tylandavis]

even though I cannot read the field, I still get a (incorrect) value back?

You cannot read the field's value, so you get the default value. It's not really incorrect because it was explicitly set as the default.

I agree its odd, and maybe there are two things happening here (default value and fallback value) that need to be sorted out.

[JarrodMFlesch]

It's not really incorrect because it was explicitly set as the default.

I would agree with this sentiment if we were talking about creating a document, but we are talking about reading it. If you cannot read the field, I don't think you should get any value back.

[JarrodMFlesch]

@tylandavis I would like another set of eyes for sure. I will loop @jmikrut in here!

[DanRibbens]

I agree with Jarrod and the fix for this PR. This is a new problem since I added this new defaultValue feature that sets it outgoing if a value didn't exist before. I hadn't considered access control with my change. Before this change this scenario wasn't possible, so not a breaking change since this is just a bug with a very recent change.