Privacy rules for list data field

[sensei01]

I have the data type tasks which has the data field list of users.

I want to do a search for tasks whose list of users contains current user. BUT I do not want the search to send back the full list of users but only the user which is the current user.

How can I achieve this?

[cmarchan]

Hello @sensei01

Would this work? (just replace task for list when you look at it)

[sensei01]

hmm I am not really sure. The output should be the list of ALL tasks whose
list of users contains current user, AND I want the list of users to return only the current user (i.e. if the list of users contains other users I don’t want the backend to send those users).

your solution only returns 1 task if I am not wrong?

[cmarchan]

Use a repeating group instead with the same expression except :first item

[sensei01]

Yes, but then I would still have the list of other users .
What I want is e.g.:
I have a

1. task1 → with list of users = current_user_name, name2, name3
2. task2 → with list of users = name2, name3

I want the server to return
task1 → with list of users = current_user_name

[ed727]

@sensei01

I want the list of users to return only the current user (i.e. if the list of users contains other users I don’t want the backend to send those users).

If it’s a list field, you can use privacy rules to make that field private or not, but it’s an all or nothing thing, in that if it’s viewable, the whole list will be downloaded as part of the record. This is one of the downsides of list fields.

That said, my guess is that the list field would only contain the uniqueID of each related record. So I’d test it and dig around Chrome Dev tools to see if it downloads any sensitive info on users.