BuilderIO / BuilderIO/builder

Field of type "reference" restricted to specific model allows to choose entry of some random model

Open
#3,052 1 comment 0 reactions 0 assignees View on GitHub
Stale
Dominant language
TypeScript
Stars
8.8k
Forks
1.2k
Avg merge
1d 6h
Merged PRs (30d)
17

Description

**Describe the bug**
Field of type `reference` restricted to specific model allows to choose entry from different model if user has no access to the model which it should be restricted to.
To simplify: There is model "model-a" which can be only accessed by Admin. There is some custom component with field of type `reference` with restriction to use only model "model-a" e.g:
```
{
name: "referenceToModelA",
type: "reference",
model: "model-a"
}
```
Then user who is not admin and has no access to the model "model-a" clicks button to select entry of the reference. This user can see list of entries which aren't model "model-a".

**To Reproduce**
Steps to reproduce the behavior:
1. In Builder create model and restrict it only for some specific role
2. Create custom component with reference field and restrict this field to the created model
3. Log in to Builder on account which has not access to the created model
4. Put created custom component on the page and select reference
5. You can see list of entries which are not from the model you specified

**Expected behavior**
User without the access to the model shouldn't see entries from model which is different from specified.
Maybe there should be some information that this user cannot change the reference because this user has no access to the model.
Maybe user should not be able to change value of this field because this user has no access to the model.

**Screenshots**
Screenshot 2024-03-15 at 16 50 21
Screenshot 2024-03-15 at 16 45 38
Screenshot 2024-03-15 at 16 49 06

Contributor guide

No contributing guide indexed for this repository

Research direction

No source files or tests are named in the issue. Reproduce the problem by configuring a restricted reference model, signing in without access, and opening the reference selector; done means the user cannot see or select entries from an unrelated model and the restricted reference behavior is handled consistently.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
authorization, frontend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.