directus / directus/docs

Document Permissions being affected by the relational API Limit

Open
#332 13 comments 0 reactions 0 assignees View on GitHub
Docs
Dominant language
TypeScript
Stars
22
Forks
82
Avg merge
18h 49m
Merged PRs (30d)
4

Description

### Describe the Bug

Permissions O2M / M2O checks are limited to 100.
I have a role, the role has a O2M relation from the `directus_users` table to customers.

In the permissions I use a custom permission on the read field of the `customer` table: So the role can see anything they have created and any customers that have been assigned to them

```json
{
"_and": [
{
"_or": [
{
"user_created": {
"_eq": "$CURRENT_USER"
}
},
{
"id": {
"_in": [
"$CURRENT_USER.customers"
]
}
}
]
}
]
}
```

This works as expected except when a user has more than 100 customers assigned to them, I think the permissions check is hitting the internal API limit of 100 and just returning the first 100 customers in the data studio and API, this has a knock on effect for other items related to the customers like statements where the permissions do a similar check on customer and only returns the statements of the first 100 customers.

Double checked in MySQL to confirm the issue.

```sql
SELECT COUNT(id) AS numberOfCustomers FROM customer where account_manager = 'e1ef5c49-942e-451d-a1f0-89f33ec6258c';
```
returns 250 but in the API and data studio it only shows the first 100 customers.

under the role:
![image](https://github.com/directus/docs/assets/30078491/53b8cbda-a1d0-4383-bec5-bd8aa6eaac19)

I have not found a way to remove the limit from the permissions using filter rules other than changing the `QUERY_LIMIT_DEFAULT` on the ENV file.

Hosting is self hosted, Ubuntu instance with MySQL, tested on older versions of Directus and the latest version (v10.10.5)

### To Reproduce

O2M relationship between users and a table where the user has more than 100 items assigned to them, then configure permissions for a role according to that relationship.

### Directus Version

10.10.5

### Hosting Strategy

Self-Hosted (Custom)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.