HasRetval permissions throws app label error in update mutation (version 0.258.0)

[rickypag]

Describe the Bug

In our codebase we have this mutation

update_post: PostType = DjangoUpdateMutation(
    PostInput,
    extensions=[HasRetvalPerm("post.change_post")],
)

where a Post can have a user (author):

@strawberry_django.type(Post)
class PostType(RandomPkInterface):
    name: strawberry.auto

    user: Optional[
        Annotated["UserType", strawberry.lazy("accounts.types")]
    ] = strawberry_django.field(
        extensions=[HasSourcePerm("post.view_post")]
    )

and the input class is:

@strawberry_django.input(Post, partial=True)
class PostInput:
    id: uuid.UUID
    description: Optional[str]
    owner: Optional[OneToOneInput]

Before updating to:

• strawberry-graphql[cli]==0.258.0
• strawberry-graphql-django==0.55.1

our versions where:

• strawberry-graphql[cli]==0.242.0
• strawberry-graphql-django==0.48

and running a query like this

mutation {
  updateMeasure(input: { id: "ID" }) {
    ... on PostType {
      id
      name
      user {
        id
      }
    }
  }
}

would work properly. Hower, after the update, we get a permission error
Given perms must have same app label ("post" != "accounts")
The error is returned only if we include user in the fragment

Is there something I'm missing?
Is this the correct way to add permissions to an update mutation or is it just a bug?

System Information

• Strawberry version: 0.258.0
• Strawberry django version (if applicable): 0.55.1

Additional Context

[bellini666]

Hey @rickypag , that seems indeed correct

Could you share the full traceback that you get?

Also, does that issue happen if you use it in a query, as opposed to a mutation?

[rickypag]

Hey @bellini666,
this happens only for mutations.
The traceback is:

GraphQL request:3:17
2 |             mutation {
3 |                 updateProcessingActivity(
  |                 ^
4 |                     input: {
Traceback (most recent call last):
  File "[path]/backend/.venv/lib/python3.11/site-packages/graphql/execution/execute.py", line 523, in execute_field
    result = resolve_fn(source, info, **args)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/kertos_backend/core/graphql/custom.py", line 323, in resolve
    result = _next(root, info, *args, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/optimizer.py", line 1480, in resolve
    ret = next_(root, info, *args, **kwargs)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry/schema/schema_converter.py", line 741, in _resolver
    return _get_result_with_extensions(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry/schema/schema_converter.py", line 728, in extension_resolver
    return reduce(
           ^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/resolvers.py", line 118, in inner_wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/resolvers.py", line 85, in sync_resolver
    retval = resolver(*args, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/permissions.py", line 320, in resolve
    retval = self.resolve_for_user(
             ^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/resolvers.py", line 118, in inner_wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/resolvers.py", line 85, in sync_resolver
    retval = resolver(*args, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/permissions.py", line 742, in resolve_for_user
    return self.resolve_for_user_with_perms(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/permissions.py", line 772, in resolve_for_user_with_perms
    obj = resolver()
          ^^^^^^^^^^
  File "[path]backend/.venv/lib/python3.11/site-packages/strawberry/schema/schema_converter.py", line 723, in wrapped_get_result
    return _get_result(
           ^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry/schema/schema_converter.py", line 680, in _get_result
    return field.get_result(
           ^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/mutations/fields.py", line 172, in get_result
    return _handle_exception(e)
           ^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/mutations/fields.py", line 104, in _handle_exception
    raise error
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/mutations/fields.py", line 170, in get_result
    resolved = self.resolver(source, info, args, kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/resolvers.py", line 118, in inner_wrapper
    return f(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/resolvers.py", line 85, in sync_resolver
    retval = resolver(*args, **kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/contextlib.py", line 81, in inner
    return func(*args, **kwds)
           ^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/mutations/fields.py", line 354, in resolver
    return self.refetch(resolved, info=info)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/mutations/fields.py", line 256, in refetch
    resolved = optimize(
               ^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/optimizer.py", line 1356, in optimize
    new_store = _get_model_hints(
                ^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/optimizer.py", line 1076, in _get_model_hints
    if model_field_store := _get_hints_from_django_field(
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/optimizer.py", line 957, in _get_hints_from_django_field
    store = _get_hints_from_django_relation(
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/optimizer.py", line 870, in _get_hints_from_django_relation
    base_qs = _get_prefetch_queryset(
              ^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/optimizer.py", line 473, in _get_prefetch_queryset
    return _optimize_prefetch_queryset(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/optimizer.py", line 534, in _optimize_prefetch_queryset
    qs = field.get_queryset(
         ^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/fields/field.py", line 322, in get_queryset
    filter_with_perms(queryset, info), info, **kwargs
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/permissions.py", line 127, in filter_with_perms
    qs = filter_for_user(
         ^^^^^^^^^^^^^^^^
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/utils/query.py", line 224, in filter_for_user
    filter_for_user_q(
  File "[path]/backend/.venv/lib/python3.11/site-packages/strawberry_django/utils/query.py", line 120, in filter_for_user_q
    raise ValueError(
ValueError: Given perms must have same app label ('processing_activities' != 'accounts')

and the mutation was

mutation {
    updateProcessingActivity(
        input: {
            id: "id"
    ){
        ... on ProcessingActivityType {
            id
            owners { id }
        }
    }
}

where

@strawberry_django.type(
    ProcessingActivity, filters=ProcessingActivityFilter, order=ProcessingActivityOrder
)
class ProcessingActivityType(RandomPkInterface):
    owners: List[UserType] = strawberry_django.field()

and UserType is defined in another app.