hasura / hasura/graphql-engine
Permission not working on insert in multiple tables with auto increment field
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
### Environment
Hasura cloud Server Version: 2.1.1-cloud.1
### What is the expected behaviour?
If there is a table with an auto-increment column and you are inserting a row with a nested object that has a foreign key as the same column, then any permissions set on the relationship is not working as expected.
### Keywords
bug in permission
### What is the current behaviour?
If there is a table with auto-increment column and you are inserting a row with a nested object that has a foreign key as the same column, then permissions are not working as expected.
### How to reproduce the issue?
org_users_map table

orgs table

Permission on orgs table so that only a user can create an org for his user id only

I have orgs table (organisation), users table and org_users_map table for mapping.
Orgs table has serial auto-increment column "id" which is the primary key and org_users_map has org_id and user_id which are foreign keys.
First, a user is created into the system, after which the user creates an org. While executing an insert query in orgs it also inserts an entry in org_users_map.
```
mutation createOrg($object: orgs_insert_input = {}) {
insert_orgs_one(object: $object) {
id
}
}
```
query variable
```
{
"object": {
"email": "lakshyatu@gmail.com",
"name": "testprg",
"city": "Hyderabad",
"org_users_map": {
"data": {
"userId": 7
}
},
}
}
```
session varaibles
```
{
"x-hasura-role": "user",
"x-hasura-user-id": "7"
}
```
error
```
{
"path": "$.selectionSet.insert_orgs_one.args.object[0]",
"error": "check constraint of an insert/update permission has failed",
"code": "permission-error"
}
```
I understand that first orgs table row is inserted and then the newly generated id is passed into org_users_map, so the validation on orgs table is getting executed just after the row in orgs table is executed and there is no user_id in orgs_users_map and thus it is throwing error.
### Any possible solutions?
Open for discussion: There should be a way to trigger insert permission post whole insert.
### Can you identify the location in the source code where the problem exists?
No
### If the bug is confirmed, would you be willing to submit a PR?
Yes
Contributor guide
Assessment
This issue has not been assessed yet.