hasura / hasura/graphql-engine

Permission not working on insert in multiple tables with auto increment field

Open
#8,232 0 comments 1 reaction 0 assignees View on GitHub
k/bug
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information
### Environment
Hasura cloud Server Version: 2.1.1-cloud.1

### What is the expected behaviour?

If there is a table with an auto-increment column and you are inserting a row with a nested object that has a foreign key as the same column, then any permissions set on the relationship is not working as expected.

### Keywords

bug in permission

### What is the current behaviour?

If there is a table with auto-increment column and you are inserting a row with a nested object that has a foreign key as the same column, then permissions are not working as expected.

### How to reproduce the issue?

org_users_map table
![image](https://user-images.githubusercontent.com/20574789/155410913-269954f1-4838-4c07-b2aa-35b89e11299a.png)
orgs table
![image](https://user-images.githubusercontent.com/20574789/155410964-deea2582-214b-418a-999a-4adc964d6f21.png)
Permission on orgs table so that only a user can create an org for his user id only
![image](https://user-images.githubusercontent.com/20574789/155411192-47930c0c-3312-4223-96fb-ef5f9852bbc0.png)

I have orgs table (organisation), users table and org_users_map table for mapping.
Orgs table has serial auto-increment column "id" which is the primary key and org_users_map has org_id and user_id which are foreign keys.

First, a user is created into the system, after which the user creates an org. While executing an insert query in orgs it also inserts an entry in org_users_map.

```
mutation createOrg($object: orgs_insert_input = {}) {
insert_orgs_one(object: $object) {
id
}
}
```
query variable
```
{
"object": {
"email": "lakshyatu@gmail.com",
"name": "testprg",
"city": "Hyderabad",
"org_users_map": {
"data": {
"userId": 7
}
},
}
}
```
session varaibles
```
{
"x-hasura-role": "user",
"x-hasura-user-id": "7"
}
```
error
```
{
"path": "$.selectionSet.insert_orgs_one.args.object[0]",
"error": "check constraint of an insert/update permission has failed",
"code": "permission-error"
}
```

I understand that first orgs table row is inserted and then the newly generated id is passed into org_users_map, so the validation on orgs table is getting executed just after the row in orgs table is executed and there is no user_id in orgs_users_map and thus it is throwing error.

### Any possible solutions?

Open for discussion: There should be a way to trigger insert permission post whole insert.

### Can you identify the location in the source code where the problem exists?

No

### If the bug is confirmed, would you be willing to submit a PR?

Yes

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.