hasura / hasura/graphql-engine

Hasura Permissions behaviour inconsistent between Admin (hasura secret) and Authenticated JWT

Open
#8,092 0 comments 1 reaction 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: v2.1
CLI Version (for CLI related issue): v2.1

### Environment

OSS

### What is the expected behaviour?

I want to be able to insert an object to another table as a relationship from a query no matter what user you are on. As an administrator using hasura secret, the following query works fine. but when logged in to the user with full permissions insert permissions to the table with no checks, it does not work.

```
mutation CreateScholar($scholar_rev_share: Int, $ronin_wallet: String, $scholar_ronin_wallet: String, $alias: String, $trainer_ronin_wallet: String, $trainer_rev_share: Int, $platform_account_id: uuid) {
insert_platform_account_wallets_one(
object: {alias: $alias, platform_account_id: $platform_account_id, labels: ["SCHOLAR"], wallet: {data: {ronin_wallet: $ronin_wallet, updated_at:"2022-01-27T08:41:48+00:00"}, on_conflict: {constraint: wallet_data_pkey, update_columns: [ronin_wallet]}}, scholar: {data: {ronin_wallet: $ronin_wallet, alias: $alias, scholar_rev_share: $scholar_rev_share, trainer_rev_share: $trainer_rev_share, trainer_ronin_wallet: $trainer_ronin_wallet, platform_account_id: $platform_account_id, scholar_payment_ronin_wallet: $scholar_ronin_wallet}, on_conflict: {constraint: scholars_ronin_wallet_platform_account_id_key, update_columns: [alias, scholar_rev_share, trainer_rev_share, trainer_ronin_wallet]}}}
) {
ronin_wallet
platform_account_id
labels
__typename
}
}
```

NOTE: The above key ronin_wallet for the behaviour that is having a conflict, we are inserting the same wallet. We are trying to upsert it without making any changes. We just want to make sure we have a clean table with wallets.

### What is the current behavior?

I cannot have an authenticated user using a JWT token successfully insert the above query

### How to reproduce the issue?

1. Create a two tables, Table A has a relationship to Table B using a key.
2. Inset data in Table B that you purposefully conflict with where you will update the primary key (which won't change).
2. Insert data into table a + b in a single insert_one query starting with the parent table a.
2a. Use hasura admin secret, it works fine
2b. Use JWT token of an authenticated user, it doesn't work.

You will get the following error as a JWT user

```
{"errors":[{"extensions":{"path":"$.selectionSet.insert_platform_account_wallets_one.args.object[0].wallet","code":"not-supported"},"message":"cannot proceed to insert object relation \"wallet\" since insert to table \"wallets\" affects zero rows"}]}
```

### Any possible solutions?

I modified the query to the following to resolve my issue for now. It works both as admin and jwt user.

```
mutation CreateScholar($scholar_rev_share: Int, $ronin_wallet: String, $scholar_ronin_wallet: String, $alias: String, $trainer_ronin_wallet: String, $trainer_rev_share: Int, $platform_account_id: uuid) {
insert_wallets_one(object:{
ronin_wallet: $ronin_wallet,
}, on_conflict:{
constraint: wallet_data_pkey,
update_columns: [ronin_wallet]
}) {
ronin_wallet
}

insert_platform_account_wallets_one(
object: {
alias: $alias,
platform_account_id: $platform_account_id,
labels: ["SCHOLAR"], scholar: {
data: {
ronin_wallet: $ronin_wallet,
alias: $alias,
scholar_rev_share:
$scholar_rev_share,
trainer_rev_share: $trainer_rev_share,
trainer_ronin_wallet: $trainer_ronin_wallet,
platform_account_id: $platform_account_id,
scholar_payment_ronin_wallet: $scholar_ronin_wallet
}, on_conflict: {
constraint: scholars_ronin_wallet_platform_account_id_key,
update_columns: [alias, scholar_rev_share, trainer_rev_share, trainer_ronin_wallet]
}
}
}) {
ronin_wallet
platform_account_id
labels
__typename
}
}
```

### Can you identify the location in the source code where the problem exists?

No

### If the bug is confirmed, would you be willing to submit a PR?

Cannot.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.