Hi all! I am attempting to add the ability to disable searching certain types of documents, ie. Person A cannot search

type: [user]

, but they can search all other types (done so using the

additionalSearchParameters { filterBy }

. Is there a better way to do this? I am using NodeJS backend and the instantsearch adapter in the frontend.

Scoped API keys can do just that: https://typesense.org/docs/28.0/api/api-keys.html#generate-scoped-search-key

So that works for most queries which is great, but I'm finding if I search with

*

or an empty space, the

filter_by

is no longer respected and all documents will be returned.

This shouldn't be the case. Either the API key isn't properly defined or something else. Did you create the the API keys using the JS sdk?

Yep, created a scoped API key with the SDK

Could you point me to some reproduction steps so I can debug it myself?

Yep! This is how it is currently being used using the JS SDK

await SearchClient.collections(collection_id).documents().search({
  // NOTE: The colleciton usually includes entityD as well, but we don't want to search for it.
  // So we are omitting it from the filter_by types, the query_by fields, and the include_fields.
  
  // If I search for entityD.name directly (instead of q = "*"), it will return an empty array and
  // no hits will be found (as expected), but if I search for q = "*", it will return all the hits
  // including any hits for entityD. This is not the expected behavior.
  q: "*",
  filter_by: "accessibleTo: [<some_ids>], type: [entityA, entityB, entityC]",
  query_by: "entityA.name, entityB.name, entityC.name",
  include_fields: "id, type, entityA.name, entityB.name, entityC.name",
})