add restrict to not allow cross folder query