
Please read my thread

Observe the video

This is the model of thread:
class Thread extends Equatable {
/// {@macro report_thread}
const Thread({
required this.id,
required this.parentRef,
required this.message,
required this.createdAt,
required this.attachIds,
required this.parentType,
this.author,
this.hasChild = false,
this.isChild = false,
});
/// From Json
factory Thread.fromJson(Map<String, dynamic> json) {
return Thread(
id: json[r'$id'] as String,
parentRef: json['parentRef'] as String,
author: json['author'] != null
? User.fromJson(
json['author'] as Map<String, dynamic>,
)
: null,
createdAt: DateTime.parse(json[r'$createdAt'] as String).toLocal(),
message: json['message'] as String,
hasChild: json['hasChild'] as bool,
isChild: json['isChild'] as bool,
parentType: ThreadParentType.fromString(
json['parentType'] as String,
),
attachIds: (json['attachIds'] as List)
.map(
(item) => item as String,
)
.toList(),
);
}
/// ID of Report Thread
final String id;
/// Report ID reference
final String parentRef;
/// Author of Report Thread
final User? author;
/// Attachments of Report Thread
final List<String> attachIds;
/// Message of Report Thread
final String message;
/// Created At of Report Thread
final DateTime createdAt;
/// Indicate what type of parent this thread is
final ThreadParentType parentType;
/// Indicate that this thread is child or not
final bool isChild;
/// Indicate that this thread has child or not.
final bool hasChild;

As you can see the User
property is a nullable data type, it because the author can be null because this user might not have the permission to read the user that associate with this thread.

However, when there is a new event of realtime it bypass the permission. He can see the Author. Because the Realtime event itself it provides the Author in payload. It seems there is no guard or middleware on the realtime


The Muslimin Ontong, is provided by Realtime Event, not from fetching documents.

When I fetch documents, it gets my expectation. The User author
will be null since that user does not have the permission. I hope you guys understand what is the goal of this problem

If you are curios, how does Administrator generate? THen this is the flow

Recommended threads
- Sharing cookies
Hi, I’m using Appwrite Cloud, and I have a setup where my Appwrite backend is hosted on a subdomain (e.g., api.example.com), while my frontend (Next.js app) and...
- Custom Domain Issue
i have added a custom domain about 21 hours ago, but till now there is no SSL certificate is active on it. but if i do DNS check via https://dnschecker.org/#C...
- Flutter OAuth2 Google does not return to...
When the flow starts, the browser opens, I select an account, and it keeps showing: """ Page not found The page you're looking for doesn't exist. `general_rout...
