handle not found case

lib/endpoint.ex

@@ -46,7 +46,7 @@ defmodule AshGraphql.Endpoint do
       defp is_forbidden(%{errors: errors}) do
         errors
         |> List.wrap()
-        |> Enum.any?(fn error -> Map.get(error, :code) == "forbidden" end)
+        |> Enum.any?(fn error -> Map.get(error, :code) in ["forbidden", "not_found"] end)
       end
 
       defp is_forbidden(_), do: false

lib/graphql/resolver.ex

@@ -513,7 +513,7 @@ defmodule AshGraphql.Graphql.Resolver do
     query =
       AshGraphql.Subscription.query_for_subscription(
         resource
-        |> Ash.Query.new(),
+        |> Ash.Query.for_read(:read, %{}, actor: Map.get(context, :actor)),
         domain,
         resolution
       )
@@ -525,7 +525,14 @@ defmodule AshGraphql.Graphql.Resolver do
         Ash.Query.filter(query, ^ref(key) == ^value)
       end)
 
-    case query |> domain.read_one(actor: resolution.context[:current_user]) do
+    case query |> domain.read_one() do
+      # should only happen if a resource is created/updated and the subscribed user is not allowed to see it
+      {:ok, nil} ->
+        resolution
+        |> Absinthe.Resolution.put_result(
+          {:error, to_errors([Ash.Error.Query.NotFound.exception()], context, domain)}
+        )
+
       {:ok, result} ->
         resolution
         |> Absinthe.Resolution.put_result({:ok, result})

lib/resource/subscription/default_config.ex

@@ -26,9 +26,10 @@ defmodule AshGraphql.Resource.Subscription.DefaultConfig do
             # context_id is exposed to the client so we might need to encrypt it
             # or save it in ets or something and send generate a hash or something
             # as the context_id
-            {:ok, topic: "*", context_id: Base.encode64(:erlang.term_to_binary(filter))}
+            dbg(filter)
+            {:ok, topic: "*", context_id: dbg(Base.encode64(:erlang.term_to_binary(filter)))}
 
-          _ ->
+          e ->
             {:error, "unauthorized"}
         end
       end