Ensure PERMISSIONS clauses are not run for ROOT / NS / DB users

lib/src/doc/pluck.rs

@@ -55,19 +55,26 @@ impl<'a> Document<'a> {
 			for fd in self.fd(opt, txn).await?.iter() {
 				// Loop over each field in document
 				for k in out.each(&fd.name).iter() {
-					// Process field permissions
+					// Check for a PERMISSIONS clause
-					match &fd.permissions.select {
+					if opt.perms && opt.auth.perms() {
-						Permission::Full => (),
+						// Process field permissions
-						Permission::None => out.del(ctx, opt, txn, k).await?,
+						match &fd.permissions.select {
-						Permission::Specific(e) => {
+							Permission::Full => (),
-							// Get the current value
+							Permission::None => out.del(ctx, opt, txn, k).await?,
-							let val = self.current.pick(k);
+							Permission::Specific(e) => {
-							// Configure the context
+								// Get the current value
-							let mut ctx = Context::new(ctx);
+								let val = self.current.pick(k);
-							ctx.add_value("value".into(), &val);
+								// Configure the context
-							// Process the PERMISSION clause
+								let mut ctx = Context::new(ctx);
-							if !e.compute(&ctx, opt, txn, Some(&self.current)).await?.is_truthy() {
+								ctx.add_value("value".into(), &val);
-								out.del(&ctx, opt, txn, k).await?
+								// Process the PERMISSION clause
+								if !e
+									.compute(&ctx, opt, txn, Some(&self.current))
+									.await?
+									.is_truthy()
+								{
+									out.del(&ctx, opt, txn, k).await?
+								}
 							}
 						}
 					}